402eda2c548f6ac74fc48ff3c0155bc8a986468cf9ddd6ce3060e7207f3680b4

Analysis

max time kernel
0s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 14:57

Reason

Reading agent response: read tcp 10.127.0.1:48474->10.127.0.9:8000: read: connection timed out

Target

402eda2c548f6ac74fc48ff3c0155bc8a986468cf9ddd6ce3060e7207f3680b4.exe
Size

100KB
MD5

46cc405412abc8355a95bdc23d5e9c63
SHA1

fae5cefdf8ce6561a7a2d75a558707ba8e6196f4
SHA256

402eda2c548f6ac74fc48ff3c0155bc8a986468cf9ddd6ce3060e7207f3680b4
SHA512

3be34c9ee5eb8c1234537735d4d1f7a4cb2abe794f6a028be7b27eb1c0567c939ae09e2c1578a5a3b1240cdfc4fb24db658e4424c3862138a41933c3cf66c07a
SSDEEP

1536:ULMPP852olvx4d/2tTuvJUrTwO7GchBw6pFtxuxxjslv:5PZolvqUTuvJm7GC+6pF/uxxyv

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	1652	402eda2c548f6ac74fc48ff3c0155bc8a986468cf9ddd6ce3060e7207f3680b4.exe

C:\Users\Admin\AppData\Local\Temp\402eda2c548f6ac74fc48ff3c0155bc8a986468cf9ddd6ce3060e7207f3680b4.exe
"C:\Users\Admin\AppData\Local\Temp\402eda2c548f6ac74fc48ff3c0155bc8a986468cf9ddd6ce3060e7207f3680b4.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1652