14dff9cff268e30dc2a8653a222dbf9fe856fd7c6c25b4851f299690753972ef

Analysis

max time kernel
27s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 07:28

Target

14dff9cff268e30dc2a8653a222dbf9fe856fd7c6c25b4851f299690753972ef.exe
Size

8KB
MD5

6bb87499a0426ecd3474b4472b81b53e
SHA1

76eb2ac67398a1e6a53df88022b2288424d02543
SHA256

14dff9cff268e30dc2a8653a222dbf9fe856fd7c6c25b4851f299690753972ef
SHA512

11db012f964d8f74e8cecf07f3660157181f4440b3c491aa4ecb0f269e41f5adf882e33abc45f4774389336ce0ebe293c79da88d17b052a57603defa66daafc3
SSDEEP

192:n0c0jZLvEPRMKYt46vBlEyncjWOYgb32gmxQdpkwbPv7:CD2MBt46tnQbWQowbb

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1020	14dff9cff268e30dc2a8653a222dbf9fe856fd7c6c25b4851f299690753972ef.exe

C:\Users\Admin\AppData\Local\Temp\14dff9cff268e30dc2a8653a222dbf9fe856fd7c6c25b4851f299690753972ef.exe
"C:\Users\Admin\AppData\Local\Temp\14dff9cff268e30dc2a8653a222dbf9fe856fd7c6c25b4851f299690753972ef.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1020