68f5285dfe87afb365e7b62a999d517fe4122ccbe82571c059803409f9182679

Analysis

max time kernel
39s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
17-12-2022 00:48

Target

TradingView-x64/TradingView Desktop.exe
Size

395KB
MD5

b91f1d5bf7dfcb98f34ff278ffbaa6fe
SHA1

3d8b75f608bc44c278bd9323fd1b3153d8775152
SHA256

2ec0754442f816dab7532fc89c9aa42452fa415b49fa0e7c601ec48877753f23
SHA512

6c058c2d4566b4aec5c6ddc5b8e30c47bc5be4242bf5e50890ea3a4a5b3e7efd8ff34a6dd542b3b7c932a2507574ab7866a415f1c20a1fc26ac15c73e22758a2
SSDEEP

12288:++S3+5jXRqTRxK7ilVyptwO5Rczcn7GI:+tK9AhCtw0g

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

TradingView Desktop.exe

description pid process target process

PID 1388 set thread context of 764 1388 TradingView Desktop.exe Caspol.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

TradingView Desktop.exe

pid process

1388 TradingView Desktop.exe
1388 TradingView Desktop.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

TradingView Desktop.exe

description pid process

Token: SeDebugPrivilege 1388 TradingView Desktop.exe

description	pid	process	target process
PID 1388 set thread context of 764	1388	TradingView Desktop.exe	Caspol.exe

pid	process
1388	TradingView Desktop.exe
1388	TradingView Desktop.exe

description	pid	process
Token: SeDebugPrivilege	1388	TradingView Desktop.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

TradingView Desktop.exe

description	pid	process	target process
PID 1388 wrote to memory of 1352	1388	TradingView Desktop.exe	Caspol.exe
PID 1388 wrote to memory of 1352	1388	TradingView Desktop.exe	Caspol.exe
PID 1388 wrote to memory of 1352	1388	TradingView Desktop.exe	Caspol.exe
PID 1388 wrote to memory of 1352	1388	TradingView Desktop.exe	Caspol.exe
PID 1388 wrote to memory of 112	1388	TradingView Desktop.exe	Caspol.exe
PID 1388 wrote to memory of 112	1388	TradingView Desktop.exe	Caspol.exe
PID 1388 wrote to memory of 112	1388	TradingView Desktop.exe	Caspol.exe
PID 1388 wrote to memory of 112	1388	TradingView Desktop.exe	Caspol.exe
PID 1388 wrote to memory of 764	1388	TradingView Desktop.exe	Caspol.exe
PID 1388 wrote to memory of 764	1388	TradingView Desktop.exe	Caspol.exe
PID 1388 wrote to memory of 764	1388	TradingView Desktop.exe	Caspol.exe
PID 1388 wrote to memory of 764	1388	TradingView Desktop.exe	Caspol.exe
PID 1388 wrote to memory of 764	1388	TradingView Desktop.exe	Caspol.exe
PID 1388 wrote to memory of 764	1388	TradingView Desktop.exe	Caspol.exe
PID 1388 wrote to memory of 764	1388	TradingView Desktop.exe	Caspol.exe
PID 1388 wrote to memory of 764	1388	TradingView Desktop.exe	Caspol.exe
PID 1388 wrote to memory of 764	1388	TradingView Desktop.exe	Caspol.exe
PID 1388 wrote to memory of 764	1388	TradingView Desktop.exe	Caspol.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
2⤵
PID:1352

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
2⤵
PID:112

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
2⤵
PID:764

memory/764-56-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/764-57-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/764-59-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/764-66-0x000000000042DD9C-mapping.dmp

Download
memory/764-68-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/764-65-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/764-63-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/764-61-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/764-69-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1388-54-0x0000000001250000-0x00000000012B2000-memory.dmp

Filesize
392KB

Download
memory/1388-55-0x0000000000440000-0x000000000044A000-memory.dmp

Filesize
40KB

Download