c70e314a85c183b41b319577e1ebad64353b883018cac97de2188520dbcd778e

Analysis

max time kernel
8s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
22-10-2022 06:14

Target

c70e314a85c183b41b319577e1ebad64353b883018cac97de2188520dbcd778e.exe
Size

424KB
MD5

7db02f9228554043de47b354221c8bca
SHA1

bbe4cd030c70151abd8dbf9e68caedc05e61dbde
SHA256

c70e314a85c183b41b319577e1ebad64353b883018cac97de2188520dbcd778e
SHA512

ba67aefe72db0025fea7222e6357e4d506bdc0054bcd59d7d5d41d147da063c1f89d29149f340d4896258851289da797a0957e8340d3e9bb58c7189d362b7ed9
SSDEEP

6144:lg696TSBF7DRiH9Pyn65fNkKJXXj8p8HmHorKspEJihalpr70PoXbftChXW3Axfg:t96kNqmMNTFQaEorEJ4E5blCJxfS6

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c70e314a85c183b41b319577e1ebad64353b883018cac97de2188520dbcd778e.exe

description pid process

Token: SeDebugPrivilege 1484 c70e314a85c183b41b319577e1ebad64353b883018cac97de2188520dbcd778e.exe

description	pid	process
Token: SeDebugPrivilege	1484	c70e314a85c183b41b319577e1ebad64353b883018cac97de2188520dbcd778e.exe

C:\Users\Admin\AppData\Local\Temp\c70e314a85c183b41b319577e1ebad64353b883018cac97de2188520dbcd778e.exe
"C:\Users\Admin\AppData\Local\Temp\c70e314a85c183b41b319577e1ebad64353b883018cac97de2188520dbcd778e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1484

memory/1484-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1484-55-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1484-59-0x0000000001EB0000-0x0000000001F35000-memory.dmp

Filesize
532KB

Download