57e85409564bed14d33d2ae2663b2bc64f99588c83b208f9091eceaf87097c1b

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-10-2022 07:18

Target

b7756f9d9e8c5f4ba2c930adb666fbae.exe
Size

100KB
MD5

b7756f9d9e8c5f4ba2c930adb666fbae
SHA1

8ddb9f2a559f6af5ccaa04c8b5b589d216357340
SHA256

57e85409564bed14d33d2ae2663b2bc64f99588c83b208f9091eceaf87097c1b
SHA512

c5c85c86251c34530b672de0feee38bd148cddd53beb7191a250f09e6d504460c343a0f608e2002434e4b98585e61222f44bc159bfb2a340c0e73a3941bef67f
SSDEEP

1536:DQIAibOVOk3udovOyePC9Eop2h90L64QG9iDCzPgQD8Kg90a//MudDBG:DQ/ibOcIudovOy8CUwIOkCzgQq0UzxM

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b7756f9d9e8c5f4ba2c930adb666fbae.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1980	b7756f9d9e8c5f4ba2c930adb666fbae.exe
Token: SeRestorePrivilege	1980	b7756f9d9e8c5f4ba2c930adb666fbae.exe

C:\Users\Admin\AppData\Local\Temp\b7756f9d9e8c5f4ba2c930adb666fbae.exe
"C:\Users\Admin\AppData\Local\Temp\b7756f9d9e8c5f4ba2c930adb666fbae.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1980