bb1a60d48e67a57b363bc312e01f4d91a7dae7e4a11653156e554d468578e8f2

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 13:11

Target

263d8628ff6e9c99318da99bb42007f4.exe
Size

2.0MB
MD5

263d8628ff6e9c99318da99bb42007f4
SHA1

c0450285843855e54b2b5aa7ee8d1a2f524218e9
SHA256

bb1a60d48e67a57b363bc312e01f4d91a7dae7e4a11653156e554d468578e8f2
SHA512

93d6a334ea62a876bab4c2c904b515fae2de919f9d5813123fbf38a02e76f02f026528d8db031e01baa525edad242683a689418eab8d3f8aab489d55c45b8114
SSDEEP

1536:waXjwDPE6yzTBMfT9/8n+NwRw7ySsgWNybmXfaKHFjyRcf7tZ4G5tJJmmrvf/Fco:NYPFyzTBMfw+N/Zs/N4ovsWZ93co

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2200	263d8628ff6e9c99318da99bb42007f4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	263d8628ff6e9c99318da99bb42007f4.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2408	2200	263d8628ff6e9c99318da99bb42007f4.exe	28
PID 2200 wrote to memory of 2408	2200	263d8628ff6e9c99318da99bb42007f4.exe	28
PID 2200 wrote to memory of 2408	2200	263d8628ff6e9c99318da99bb42007f4.exe	28
PID 2200 wrote to memory of 2408	2200	263d8628ff6e9c99318da99bb42007f4.exe	28

C:\Users\Admin\AppData\Local\Temp\263d8628ff6e9c99318da99bb42007f4.exe
"C:\Users\Admin\AppData\Local\Temp\263d8628ff6e9c99318da99bb42007f4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  PID:2408

memory/2200-0-0x0000000074D90000-0x000000007547E000-memory.dmp

Filesize
6.9MB

Download
memory/2200-1-0x0000000000210000-0x0000000000418000-memory.dmp

Filesize
2.0MB

Download
memory/2200-2-0x00000000001E0000-0x00000000001F2000-memory.dmp

Filesize
72KB

Download
memory/2200-3-0x0000000074D90000-0x000000007547E000-memory.dmp

Filesize
6.9MB

Download