93a80d67b37cc6bd27ec07dce5fa342e920c3edef436e78c39c3641d6f6ed79e

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 18:46

Target

PURCHASE_ORDER_PDF.exe
Size

409KB
MD5

5d7bc74a7f048e8c244bd69f01ccf57d
SHA1

a855c2016edff555fc68c2294f792d8d9f6dfd2d
SHA256

93a80d67b37cc6bd27ec07dce5fa342e920c3edef436e78c39c3641d6f6ed79e
SHA512

2d7515acce4f0c1717a9edc2f72d82db5d9e1fd14290f6a011cec20a4532060baf31db4ab4d57eff01ee94fd82398643ce327f2a0c4fc8509c81eb2b5198180e
SSDEEP

12288:rU9+PTM1L2zbnt3+GXs4xH5Y1h6/XdZzTq:rMoTMB2ntuaxZ2Wd

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2372 set thread context of 2340	2372	PURCHASE_ORDER_PDF.exe	31

Suspicious behavior: EnumeratesProcesses 7 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2340	2372	PURCHASE_ORDER_PDF.exe	31
PID 2372 wrote to memory of 2340	2372	PURCHASE_ORDER_PDF.exe	31
PID 2372 wrote to memory of 2340	2372	PURCHASE_ORDER_PDF.exe	31
PID 2372 wrote to memory of 2340	2372	PURCHASE_ORDER_PDF.exe	31
PID 2372 wrote to memory of 2340	2372	PURCHASE_ORDER_PDF.exe	31
PID 2372 wrote to memory of 2340	2372	PURCHASE_ORDER_PDF.exe	31
PID 2372 wrote to memory of 2340	2372	PURCHASE_ORDER_PDF.exe	31

C:\Users\Admin\AppData\Local\Temp\PURCHASE_ORDER_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\PURCHASE_ORDER_PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2340

memory/2340-7-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2340-12-0x0000000000C10000-0x0000000000F13000-memory.dmp

Filesize
3.0MB

Download
memory/2340-13-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2340-6-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2340-9-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2340-11-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2340-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2372-4-0x0000000000250000-0x000000000025C000-memory.dmp

Filesize
48KB

Download
memory/2372-1-0x00000000002E0000-0x000000000034C000-memory.dmp

Filesize
432KB

Download
memory/2372-0-0x000007FEF5E53000-0x000007FEF5E54000-memory.dmp

Filesize
4KB

Download
memory/2372-10-0x000007FEF5E50000-0x000007FEF683C000-memory.dmp

Filesize
9.9MB

Download
memory/2372-5-0x0000000000260000-0x0000000000268000-memory.dmp

Filesize
32KB

Download
memory/2372-3-0x000007FEF5E50000-0x000007FEF683C000-memory.dmp

Filesize
9.9MB

Download
memory/2372-2-0x000000001B480000-0x000000001B4E8000-memory.dmp

Filesize
416KB

Download