42de4f761e2dbd9cfd4c7e0fe72d518c96df1b96070d1941d6d99c0d1fb293f8

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 05:30

Target

42de4f761e2dbd9cfd4c7e0fe72d518c96df1b96070d1941d6d99c0d1fb293f8.exe
Size

223KB
MD5

10e84fdd9727c7418d21e901e0317936
SHA1

3323a77388e9751a3dc62a7c0894a451717225cc
SHA256

42de4f761e2dbd9cfd4c7e0fe72d518c96df1b96070d1941d6d99c0d1fb293f8
SHA512

8040b44ffd946ee9d1c7ee7993b64ed368c9f9855ffe08b731338e38918a195a34273ed683d04d89ddf4a39e9fb779bf5234021c44cdeffa123d5cefd5395035
SSDEEP

6144:akk1I34X9th32HMgPuNfa6xdue5cRCxFk+h0SjQSbb:akk1I34tthvfawduwcMxFmyb

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1976-54-0x0000000001000000-0x0000000001075000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	42de4f761e2dbd9cfd4c7e0fe72d518c96df1b96070d1941d6d99c0d1fb293f8.exe

C:\Users\Admin\AppData\Local\Temp\42de4f761e2dbd9cfd4c7e0fe72d518c96df1b96070d1941d6d99c0d1fb293f8.exe
"C:\Users\Admin\AppData\Local\Temp\42de4f761e2dbd9cfd4c7e0fe72d518c96df1b96070d1941d6d99c0d1fb293f8.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1976

memory/1976-54-0x0000000001000000-0x0000000001075000-memory.dmp

Filesize
468KB

Download