8feeb31be2e79fc5c6ddd489dcbfe708c8890f107e32c788ec1b7842feead9d4

Analysis

max time kernel
151s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08/09/2022, 06:37

Target
Order confirmation PO 45003271..exe
Size 32KB
Sample220908-hdg4asbbak
SHA256 8feeb31be2e79fc5c6ddd489dcbfe708c8890f107e32c788ec1b7842feead9d4
MD5 09de25091f6ec1af1b6cb9445ea8b15a
SHA1 b8f169cae7f09a1445828d09b8139b37bbc1811c
SHA512 41aa3e869ec8be3998ae5d50431d4f977dcb5ec14f99067ec3851e284d402425c07d38aac4042687a67e4e9cf0f6f5272d2dc8fb5a0ff92944894877d086097b
SSDEEP 768:8ma3IdUcpBxCQvA8OKtGbyukhKqeteXoJrRMcE:850zBxfAfKtGtk9weYnM1
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1096	Order confirmation PO 45003271..exe

C:\Users\Admin\AppData\Local\Temp\Order confirmation PO 45003271..exe
"C:\Users\Admin\AppData\Local\Temp\Order confirmation PO 45003271..exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1096

memory/1096-54-0x0000000000CC0000-0x0000000000CCC000-memory.dmp

Download