39b9b9d2c699f8523e55a05bfc74f6f5764fabb0a1418f1cec4bc78609c1b37b

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12-08-2022 15:42

Target

Order #165-3520P-WTMM10X.exe
Size

261KB
MD5

2bf6d8556ca6620a7f3802521da5c138
SHA1

68ad243311f33ed4cfb4b3d75c9e3f0a271be58f
SHA256

39b9b9d2c699f8523e55a05bfc74f6f5764fabb0a1418f1cec4bc78609c1b37b
SHA512

9c8e092b7f786d3a768794da9ad28c257f8b78008ffa598c76f8e6ecfcc4a6af06b60a50f3faafcbf39833e0f9d5ac96d5301bc1a7ad1f9633a0378452281dcd

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Order #165-3520P-WTMM10X.exe

description pid process

Token: SeDebugPrivilege 1508 Order #165-3520P-WTMM10X.exe

description	pid	process
Token: SeDebugPrivilege	1508	Order #165-3520P-WTMM10X.exe

C:\Users\Admin\AppData\Local\Temp\Order #165-3520P-WTMM10X.exe
"C:\Users\Admin\AppData\Local\Temp\Order #165-3520P-WTMM10X.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1508

memory/1508-54-0x0000000000240000-0x0000000000288000-memory.dmp

Filesize
288KB

Download
memory/1508-55-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/1508-56-0x0000000000515000-0x0000000000526000-memory.dmp

Filesize
68KB

Download
memory/1508-57-0x00000000004E0000-0x000000000050E000-memory.dmp

Filesize
184KB

Download
memory/1508-58-0x0000000000515000-0x0000000000526000-memory.dmp

Filesize
68KB

Download