577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea

Analysis

max time kernel
150s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 06:37

Target

6b262e3cfe7e64378337669bbdf768fb.exe
Size

607KB
MD5

6b262e3cfe7e64378337669bbdf768fb
SHA1

6f2c63adcdda5114299344058464016be1a87c70
SHA256

577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea
SHA512

36e39838c5cd75ff3f14a8d46cfcd9e3ebe12d9c9f35e9fdb6337a3e947d51e383c6800a34a76aab7b9fafd57032110f601c85acf7d19bf381b4e58a13e8363c
SSDEEP

12288:dh1Lk70TnvjcZsqnY9LH8Vaxc07BK9GGjcCUfHP2kuGZiCKAzDN/ELq:Zk70TrcZr3ycKNubUfHDFkCK8h/1

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1316	6b262e3cfe7e64378337669bbdf768fb.exe
1316	6b262e3cfe7e64378337669bbdf768fb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1316	6b262e3cfe7e64378337669bbdf768fb.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 3360	1316	6b262e3cfe7e64378337669bbdf768fb.exe	92
PID 1316 wrote to memory of 3360	1316	6b262e3cfe7e64378337669bbdf768fb.exe	92
PID 1316 wrote to memory of 3360	1316	6b262e3cfe7e64378337669bbdf768fb.exe	92

C:\Users\Admin\AppData\Local\Temp\6b262e3cfe7e64378337669bbdf768fb.exe
"C:\Users\Admin\AppData\Local\Temp\6b262e3cfe7e64378337669bbdf768fb.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  PID:3360

memory/1316-0-0x0000000074B80000-0x0000000075330000-memory.dmp

Filesize
7.7MB

Download
memory/1316-1-0x0000000074B80000-0x0000000075330000-memory.dmp

Filesize
7.7MB

Download
memory/1316-2-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download
memory/1316-3-0x00000000050E0000-0x000000000531E000-memory.dmp

Filesize
2.2MB

Download
memory/1316-4-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download
memory/1316-5-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download
memory/1316-6-0x0000000005320000-0x00000000058C4000-memory.dmp

Filesize
5.6MB

Download
memory/1316-7-0x0000000004EA0000-0x00000000050DC000-memory.dmp

Filesize
2.2MB

Download
memory/1316-8-0x0000000002390000-0x00000000023A2000-memory.dmp

Filesize
72KB

Download
memory/1316-9-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download
memory/1316-11-0x0000000074B80000-0x0000000075330000-memory.dmp

Filesize
7.7MB

Download