583431576fc175e19758774ec8b2893431aafe9a58c025406f22281b60f1aef0

Analysis

max time kernel
10s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
22-10-2022 05:32

Target

583431576fc175e19758774ec8b2893431aafe9a58c025406f22281b60f1aef0.exe
Size

424KB
MD5

c6665caa8d5455b1643bc72fe55b0ade
SHA1

eac5cb2ca1661c2f282393d0cdc52d8bfc1dea42
SHA256

583431576fc175e19758774ec8b2893431aafe9a58c025406f22281b60f1aef0
SHA512

921412255db2b5b5a076f773468f63c56411f06bb249121160e8695ea9bbc75714e2034a14d79275cb024d18708f7ebf5aad69d780b831384d2cb603fed7255c
SSDEEP

12288:eL2WjWgDhrhjxaRaDz7z4HMLzskGWoXblCJxfS6:eDXpVx7f7dLoMorOR1

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

583431576fc175e19758774ec8b2893431aafe9a58c025406f22281b60f1aef0.exe

description pid process

Token: SeDebugPrivilege 1464 583431576fc175e19758774ec8b2893431aafe9a58c025406f22281b60f1aef0.exe

description	pid	process
Token: SeDebugPrivilege	1464	583431576fc175e19758774ec8b2893431aafe9a58c025406f22281b60f1aef0.exe

C:\Users\Admin\AppData\Local\Temp\583431576fc175e19758774ec8b2893431aafe9a58c025406f22281b60f1aef0.exe
"C:\Users\Admin\AppData\Local\Temp\583431576fc175e19758774ec8b2893431aafe9a58c025406f22281b60f1aef0.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1464

memory/1464-54-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download
memory/1464-55-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1464-59-0x00000000004B0000-0x0000000000535000-memory.dmp

Filesize
532KB

Download