2fad5fb99831e5e600023e5b015cba99a23cb7bfaba42e81ad2b2aa6cb8c7ecd

Analysis

max time kernel
8s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
22-10-2022 10:29

Target

2fad5fb99831e5e600023e5b015cba99a23cb7bfaba42e81ad2b2aa6cb8c7ecd.exe
Size

348KB
MD5

96bf108af2eafc33969cfb9f8ace6a25
SHA1

f170c820fac79c4851061980b1eaa3318c3d2377
SHA256

2fad5fb99831e5e600023e5b015cba99a23cb7bfaba42e81ad2b2aa6cb8c7ecd
SHA512

635d942a295da9b77fcd1e80864bf11a4fe7f6ea3075c152511be9b7e411af0ca11c67b99305ff9a40a99cc106ba613365c936f357b7e30376c7ddd01f1dc46c
SSDEEP

6144:tTyNbpChrXMCfgR0R42+YKHZaOMMQB6WCtQ+tugD3lmhcJvF:tTsparXN4g+HZafFE6gLlmhcJv

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2fad5fb99831e5e600023e5b015cba99a23cb7bfaba42e81ad2b2aa6cb8c7ecd.exe

description pid process

Token: SeDebugPrivilege 2028 2fad5fb99831e5e600023e5b015cba99a23cb7bfaba42e81ad2b2aa6cb8c7ecd.exe

description	pid	process
Token: SeDebugPrivilege	2028	2fad5fb99831e5e600023e5b015cba99a23cb7bfaba42e81ad2b2aa6cb8c7ecd.exe

C:\Users\Admin\AppData\Local\Temp\2fad5fb99831e5e600023e5b015cba99a23cb7bfaba42e81ad2b2aa6cb8c7ecd.exe
"C:\Users\Admin\AppData\Local\Temp\2fad5fb99831e5e600023e5b015cba99a23cb7bfaba42e81ad2b2aa6cb8c7ecd.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2028

memory/2028-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/2028-55-0x0000000000400000-0x000000000049B000-memory.dmp

Filesize
620KB

Download
memory/2028-59-0x0000000000330000-0x00000000003B6000-memory.dmp

Filesize
536KB

Download