750361a8039bd9876939ca3ee37312821f8cd019eabe123ef884b30433757677

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
06/07/2023, 05:46

Target

Satınalma Siparişi 20230331,pdf.exe
Size

883KB
MD5

1ca97b277f12cd92dde0dbfe99e03dee
SHA1

2b5a76c34ed53e8c459851c977f80f6d1c1feb94
SHA256

750361a8039bd9876939ca3ee37312821f8cd019eabe123ef884b30433757677
SHA512

5494cf533a9ad4e67009db0f5cf8d9343914475e075dd54bc32c52edb2a4c0d35760a879630ed4df2eb7866c31de6c40568fd2a75e5981225e543fee423f234c
SSDEEP

24576:uk70TrcFS0Xcfa9sh6yxVUeLNSCDzBIjUIp07RtPP4Ztq:ukQTAc0XB9fNwUUIp07fPwg

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2948	Satınalma Siparişi 20230331,pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2948	Satınalma Siparişi 20230331,pdf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 1764	2948	Satınalma Siparişi 20230331,pdf.exe	28
PID 2948 wrote to memory of 1764	2948	Satınalma Siparişi 20230331,pdf.exe	28
PID 2948 wrote to memory of 1764	2948	Satınalma Siparişi 20230331,pdf.exe	28
PID 2948 wrote to memory of 1764	2948	Satınalma Siparişi 20230331,pdf.exe	28

C:\Users\Admin\AppData\Local\Temp\Satınalma Siparişi 20230331,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Satınalma Siparişi 20230331,pdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  PID:1764

memory/2948-54-0x0000000004B00000-0x0000000004BC4000-memory.dmp

Filesize
784KB

Download
memory/2948-55-0x0000000004990000-0x0000000004A52000-memory.dmp

Filesize
776KB

Download
memory/2948-56-0x0000000000830000-0x0000000000840000-memory.dmp

Filesize
64KB

Download