2893876f26c73d7dce1828babf03dfd9551c3d36a7b8de144daef87d7e1e102c

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
08/08/2023, 13:41

Target

tmp.exe
Size

1.7MB
MD5

b0cd0472bad1ec1cd55f4583460bb232
SHA1

77b944827939e9ed70a36ea0ba6aab93774d1f26
SHA256

2893876f26c73d7dce1828babf03dfd9551c3d36a7b8de144daef87d7e1e102c
SHA512

f7312406429d9b72dfdda32bc88cbd6a4dd0264d130dcbf3186250def88e73dc45107db83fa24432bfa04f6de282a715dbccd30cb6daac8a0032e3c208ac23d8
SSDEEP

12288:wMsOUCuN1lXtsGG4iDv5Gap4YWUNhL8ULWjDWzIT/PLysbgK3c8hT2s1NXk3QObF:wbybOjaQP5gK3ci1ObuyfdZBOhH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2300	tmp.exe
2300	tmp.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2300	tmp.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2248	2300	tmp.exe	30
PID 2300 wrote to memory of 2248	2300	tmp.exe	30
PID 2300 wrote to memory of 2248	2300	tmp.exe	30
PID 2300 wrote to memory of 2248	2300	tmp.exe	30

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  PID:2248

memory/2300-54-0x0000000074AF0000-0x00000000751DE000-memory.dmp

Filesize
6.9MB

Download
memory/2300-55-0x0000000000270000-0x000000000042E000-memory.dmp

Filesize
1.7MB

Download
memory/2300-56-0x0000000000230000-0x0000000000242000-memory.dmp

Filesize
72KB

Download
memory/2300-57-0x0000000074AF0000-0x00000000751DE000-memory.dmp

Filesize
6.9MB

Download