4053bd7f73a8df7ae21b935bdcaeb57d768d9ddb86c5c46856b3eb7175f2e2d3

Analysis

max time kernel
8s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22-10-2022 05:24

Target

4053bd7f73a8df7ae21b935bdcaeb57d768d9ddb86c5c46856b3eb7175f2e2d3.exe
Size

424KB
MD5

df23ae2c9888695539d87c39e521930f
SHA1

da9f86e5df799d26aa3c266e0854223b3b85aac9
SHA256

4053bd7f73a8df7ae21b935bdcaeb57d768d9ddb86c5c46856b3eb7175f2e2d3
SHA512

60c2e626a74ebfe322586daf86f56da4d2abedbe03f33583ed065b0702a3eb554702b6480e66802eff1756118cc73827b7833b258c0a49b10df9eb5123ad55bb
SSDEEP

6144:dWmfUHQSVs1ZYi9Cz3cnPOqURF7T16kCQ4B1oyjqnVhyfVoXbftChXW3AxfulDGq:kmfUHQS0GiGc6R6kXP/nVAcblCJxfS6

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4053bd7f73a8df7ae21b935bdcaeb57d768d9ddb86c5c46856b3eb7175f2e2d3.exe

description pid process

Token: SeDebugPrivilege 912 4053bd7f73a8df7ae21b935bdcaeb57d768d9ddb86c5c46856b3eb7175f2e2d3.exe

description	pid	process
Token: SeDebugPrivilege	912	4053bd7f73a8df7ae21b935bdcaeb57d768d9ddb86c5c46856b3eb7175f2e2d3.exe

C:\Users\Admin\AppData\Local\Temp\4053bd7f73a8df7ae21b935bdcaeb57d768d9ddb86c5c46856b3eb7175f2e2d3.exe
"C:\Users\Admin\AppData\Local\Temp\4053bd7f73a8df7ae21b935bdcaeb57d768d9ddb86c5c46856b3eb7175f2e2d3.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:912

memory/912-54-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download
memory/912-55-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/912-59-0x0000000000340000-0x00000000003C5000-memory.dmp

Filesize
532KB

Download