6af049a58c2305e04f612698a55fba678584d4d878116ed2ee3163f32c257ac4

Analysis

max time kernel
113s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2023, 20:27

Target

Commande nr220489 E833080.exe
Size

182KB
MD5

424d1c81092c76ac4c60ed4e2af71729
SHA1

dff8164676c93499d9117b8c99d59f563dc603dd
SHA256

cb1a95879bdec08e04762f3180ab28040288232230c0a10dfd9a9344e0fa21cb
SHA512

a63edebd3716d66a1959b924d2c5b00e3e5b0897325bae2923e99568a3a66e3bcc837d8aaf48c7014cf4c0ab4974fae805a65ad98b01fd39dc2bb0c4a708daf0
SSDEEP

3072:38MzDbnCWsIhhNzz05DDxz7k7K4adcywN/ivkMK0jTJj8xyIL32C0gAm6:MieObz83xPkerEat3jdjcyILGI

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1784	Commande nr220489 E833080.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 3240	1784	Commande nr220489 E833080.exe	88
PID 1784 wrote to memory of 3240	1784	Commande nr220489 E833080.exe	88
PID 1784 wrote to memory of 3240	1784	Commande nr220489 E833080.exe	88
PID 1784 wrote to memory of 3480	1784	Commande nr220489 E833080.exe	89
PID 1784 wrote to memory of 3480	1784	Commande nr220489 E833080.exe	89
PID 1784 wrote to memory of 3480	1784	Commande nr220489 E833080.exe	89
PID 1784 wrote to memory of 5112	1784	Commande nr220489 E833080.exe	90
PID 1784 wrote to memory of 5112	1784	Commande nr220489 E833080.exe	90
PID 1784 wrote to memory of 5112	1784	Commande nr220489 E833080.exe	90
PID 1784 wrote to memory of 3692	1784	Commande nr220489 E833080.exe	91
PID 1784 wrote to memory of 3692	1784	Commande nr220489 E833080.exe	91
PID 1784 wrote to memory of 3692	1784	Commande nr220489 E833080.exe	91
PID 1784 wrote to memory of 4064	1784	Commande nr220489 E833080.exe	92
PID 1784 wrote to memory of 4064	1784	Commande nr220489 E833080.exe	92
PID 1784 wrote to memory of 4064	1784	Commande nr220489 E833080.exe	92

C:\Users\Admin\AppData\Local\Temp\Commande nr220489 E833080.exe
"C:\Users\Admin\AppData\Local\Temp\Commande nr220489 E833080.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  PID:3240
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  PID:3480
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  PID:5112
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  PID:3692
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  PID:4064

memory/1784-133-0x0000023C08650000-0x0000023C0867A000-memory.dmp

Filesize
168KB

Download