d445bcc612d30247be40a85c3dc176b05527ef33c5335e1751e17ae6d747a028

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 07:15

Target

Par veidlapas iesniegsanu CSP 25032024_pdf.exe
Size

1.2MB
MD5

ec1feff9acfe4ac55d2ed42387c46c01
SHA1

c42aadd494df06ad31ed72317f44840669e217b6
SHA256

d445bcc612d30247be40a85c3dc176b05527ef33c5335e1751e17ae6d747a028
SHA512

27131a8f26601516cd4aaebe8d0fc4d10f8d0c8ac742c7a620e3bff308e2ce2506b17d4a2e1ff3353019c82c38185c63c5856779eaff0c5b963d57e71b8d66ef
SSDEEP

6144:F7OpgjdiWe/i0lsSzWaAyQHrQi9idhOwdfPFrc3sLClUN+cvlLlHD1qTwSDlKDtn:FfN0iWgWltSDlKDtf5DXB

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
488	Par veidlapas iesniegsanu CSP 25032024_pdf.exe
488	Par veidlapas iesniegsanu CSP 25032024_pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	488	Par veidlapas iesniegsanu CSP 25032024_pdf.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 488 wrote to memory of 4988	488	Par veidlapas iesniegsanu CSP 25032024_pdf.exe	87
PID 488 wrote to memory of 4988	488	Par veidlapas iesniegsanu CSP 25032024_pdf.exe	87
PID 488 wrote to memory of 4988	488	Par veidlapas iesniegsanu CSP 25032024_pdf.exe	87

C:\Users\Admin\AppData\Local\Temp\Par veidlapas iesniegsanu CSP 25032024_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Par veidlapas iesniegsanu CSP 25032024_pdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:488
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4988

memory/488-0-0x0000000000FB0000-0x00000000010DC000-memory.dmp

Filesize
1.2MB

Download
memory/488-2-0x00007FFB02160000-0x00007FFB02C21000-memory.dmp

Filesize
10.8MB

Download
memory/488-1-0x0000000001880000-0x0000000001898000-memory.dmp

Filesize
96KB

Download
memory/488-4-0x00007FFB02160000-0x00007FFB02C21000-memory.dmp

Filesize
10.8MB

Download