112895b420d604979ba6b78c756063f0c17146097a41795d0922c2a173415c7e

Analysis

max time kernel
47s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22-10-2022 07:59

Target

112895b420d604979ba6b78c756063f0c17146097a41795d0922c2a173415c7e.exe
Size

428KB
MD5

5199b690874c0baa375855e37789569e
SHA1

ce65f46da270330e66da4fa879932f091f01fcc9
SHA256

112895b420d604979ba6b78c756063f0c17146097a41795d0922c2a173415c7e
SHA512

0fab6da9d104884a4300317e9a00ee909995ce7bd6afb76bfdcd220543591ebc66c572c819029dfe30729538dd18930da95b34192a36da4509cdce0d85b2dbfb
SSDEEP

12288:RGWf3BWLqi/f3xF7PxqViWValazc5ICyPFblCJxfS6:PBSqi/fxWiWVQqJOR1

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

112895b420d604979ba6b78c756063f0c17146097a41795d0922c2a173415c7e.exe

description pid process

Token: SeDebugPrivilege 1360 112895b420d604979ba6b78c756063f0c17146097a41795d0922c2a173415c7e.exe

description	pid	process
Token: SeDebugPrivilege	1360	112895b420d604979ba6b78c756063f0c17146097a41795d0922c2a173415c7e.exe

C:\Users\Admin\AppData\Local\Temp\112895b420d604979ba6b78c756063f0c17146097a41795d0922c2a173415c7e.exe
"C:\Users\Admin\AppData\Local\Temp\112895b420d604979ba6b78c756063f0c17146097a41795d0922c2a173415c7e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1360

memory/1360-54-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/1360-55-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1360-59-0x00000000004B0000-0x0000000000535000-memory.dmp

Filesize
532KB

Download