9708ca827d149b1b4f392cbf2b6f8cea286e4e90dbaff77afcc9fc3adfce9d93

Analysis

max time kernel
10s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22-10-2022 03:50

Target

9708ca827d149b1b4f392cbf2b6f8cea286e4e90dbaff77afcc9fc3adfce9d93.exe
Size

500KB
MD5

ba5e80f2d798e241471decd7fea5c32e
SHA1

0a94f3a096002197befb9dd5e6611f0fba19cf8d
SHA256

9708ca827d149b1b4f392cbf2b6f8cea286e4e90dbaff77afcc9fc3adfce9d93
SHA512

ce193d58ff73fccc14e9afcb4a2c55a70f501f563cd0be3be878ee76aee94328f0956b88bf17ad3f585b3da08c2914828d5360f85ff8b0507bc9219733ba98ff
SSDEEP

6144:a+5uzIF/dV6GdE98vJwvw8AWLG1qSrX6T26WyJNh:B5uzKdzd7RazYtT6Xh

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9708ca827d149b1b4f392cbf2b6f8cea286e4e90dbaff77afcc9fc3adfce9d93.exe

description pid process

Token: SeDebugPrivilege 1880 9708ca827d149b1b4f392cbf2b6f8cea286e4e90dbaff77afcc9fc3adfce9d93.exe

description	pid	process
Token: SeDebugPrivilege	1880	9708ca827d149b1b4f392cbf2b6f8cea286e4e90dbaff77afcc9fc3adfce9d93.exe

C:\Users\Admin\AppData\Local\Temp\9708ca827d149b1b4f392cbf2b6f8cea286e4e90dbaff77afcc9fc3adfce9d93.exe
"C:\Users\Admin\AppData\Local\Temp\9708ca827d149b1b4f392cbf2b6f8cea286e4e90dbaff77afcc9fc3adfce9d93.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1880

memory/1880-54-0x0000000076DC1000-0x0000000076DC3000-memory.dmp

Filesize
8KB

Download
memory/1880-55-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1880-59-0x0000000000280000-0x0000000000306000-memory.dmp

Filesize
536KB

Download