0409ef8d80a091a3407fea01fe571008a973ba7d265a2cba857e37a10da19d1d

Analysis

max time kernel
8s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22-10-2022 02:09

Target

0409ef8d80a091a3407fea01fe571008a973ba7d265a2cba857e37a10da19d1d.exe
Size

428KB
MD5

25d19a52635910583e2d7ae9838dafc1
SHA1

79d3eafc12de06b7d9aa24a0341bd92a40e05586
SHA256

0409ef8d80a091a3407fea01fe571008a973ba7d265a2cba857e37a10da19d1d
SHA512

b73220f16dab0b121bd50591c98641b88e20676531658d76f4e3b58a976a09deead9fa67f3be607f17ef1011ef8831e2a8901cc4cd01b5172e7cd408394003ca
SSDEEP

12288:aniPO95/KIQuuijlhVWpKvq9tsJGAEdMblCJxfS6:anCO95JDuiphsN0krUOR1

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0409ef8d80a091a3407fea01fe571008a973ba7d265a2cba857e37a10da19d1d.exe

description pid process

Token: SeDebugPrivilege 1100 0409ef8d80a091a3407fea01fe571008a973ba7d265a2cba857e37a10da19d1d.exe

description	pid	process
Token: SeDebugPrivilege	1100	0409ef8d80a091a3407fea01fe571008a973ba7d265a2cba857e37a10da19d1d.exe

C:\Users\Admin\AppData\Local\Temp\0409ef8d80a091a3407fea01fe571008a973ba7d265a2cba857e37a10da19d1d.exe
"C:\Users\Admin\AppData\Local\Temp\0409ef8d80a091a3407fea01fe571008a973ba7d265a2cba857e37a10da19d1d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1100

memory/1100-54-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download
memory/1100-55-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1100-59-0x0000000001EA0000-0x0000000001F25000-memory.dmp

Filesize
532KB

Download