577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
29-09-2023 11:46

Target

6b262e3cfe7e64378337669bbdf768fb.exe
Size

607KB
MD5

6b262e3cfe7e64378337669bbdf768fb
SHA1

6f2c63adcdda5114299344058464016be1a87c70
SHA256

577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea
SHA512

36e39838c5cd75ff3f14a8d46cfcd9e3ebe12d9c9f35e9fdb6337a3e947d51e383c6800a34a76aab7b9fafd57032110f601c85acf7d19bf381b4e58a13e8363c
SSDEEP

12288:dh1Lk70TnvjcZsqnY9LH8Vaxc07BK9GGjcCUfHP2kuGZiCKAzDN/ELq:Zk70TrcZr3ycKNubUfHDFkCK8h/1

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2976	6b262e3cfe7e64378337669bbdf768fb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2976	6b262e3cfe7e64378337669bbdf768fb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2208	2976	6b262e3cfe7e64378337669bbdf768fb.exe	28
PID 2976 wrote to memory of 2208	2976	6b262e3cfe7e64378337669bbdf768fb.exe	28
PID 2976 wrote to memory of 2208	2976	6b262e3cfe7e64378337669bbdf768fb.exe	28
PID 2976 wrote to memory of 2208	2976	6b262e3cfe7e64378337669bbdf768fb.exe	28

C:\Users\Admin\AppData\Local\Temp\6b262e3cfe7e64378337669bbdf768fb.exe
"C:\Users\Admin\AppData\Local\Temp\6b262e3cfe7e64378337669bbdf768fb.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  PID:2208

memory/2976-0-0x0000000074CB0000-0x000000007539E000-memory.dmp

Filesize
6.9MB

Download
memory/2976-1-0x0000000004B80000-0x0000000004BC0000-memory.dmp

Filesize
256KB

Download
memory/2976-2-0x0000000004E00000-0x000000000503E000-memory.dmp

Filesize
2.2MB

Download
memory/2976-3-0x0000000004B80000-0x0000000004BC0000-memory.dmp

Filesize
256KB

Download
memory/2976-4-0x0000000004BC0000-0x0000000004DFC000-memory.dmp

Filesize
2.2MB

Download
memory/2976-5-0x0000000001FC0000-0x0000000001FD2000-memory.dmp

Filesize
72KB

Download
memory/2976-6-0x0000000074CB0000-0x000000007539E000-memory.dmp

Filesize
6.9MB

Download