534bc98179bd7a6f7c7491fdee34ff06ae1d90f7bf1db29586d39a5ae971eea5

Analysis

max time kernel
143s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
30/08/2023, 06:33

Target
E-DEKONT1,PDF.exe
Size 175KB
Sample230830-ha7vjsdc4v
SHA256 534bc98179bd7a6f7c7491fdee34ff06ae1d90f7bf1db29586d39a5ae971eea5
MD5 132d693538d3d7e886c455aa18cb9e73
SHA1 40a1c2596d4b4266b137b6737976f4fbdbc9a9b7
SHA512 3bf29d37323b2dbfee09c0abbe6c20fe489a42ef5eeca388176cdffd4f5af4ef70b724ebe397a3df7454dbcfb86f3a85c12c98df346944884ee9a3cc0762c013
SSDEEP 1536:FuAY1c9wqvnAv77vvvvv7vvvvvvv7vvvvv64+mhhhm+DtqOgd:FC+9wqY+mhhhmitqO2
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1824	E-DEKONT1,PDF.exe
1824	E-DEKONT1,PDF.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1824	E-DEKONT1,PDF.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1832	1824	E-DEKONT1,PDF.exe	83
PID 1824 wrote to memory of 1832	1824	E-DEKONT1,PDF.exe	83
PID 1824 wrote to memory of 1832	1824	E-DEKONT1,PDF.exe	83

C:\Users\Admin\AppData\Local\Temp\E-DEKONT1,PDF.exe
"C:\Users\Admin\AppData\Local\Temp\E-DEKONT1,PDF.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  PID:1832

memory/1824-0-0x0000000000590000-0x00000000005C4000-memory.dmp

Download

memory/1824-1-0x0000000074470000-0x0000000074C20000-memory.dmp

Download

memory/1824-2-0x0000000004F80000-0x0000000004F90000-memory.dmp

Download

memory/1824-4-0x0000000074470000-0x0000000074C20000-memory.dmp

Download