323b8534996ed1f42e206831aa00b77c91f20e428263b1534a1db3c2abab4915

Analysis

max time kernel
9s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22-10-2022 10:41

Target

323b8534996ed1f42e206831aa00b77c91f20e428263b1534a1db3c2abab4915.exe
Size

424KB
MD5

a2801a0ac7d6204ec19ec708228e5a0b
SHA1

692a926583bcf3aed9fa28678435b6d7921e49ab
SHA256

323b8534996ed1f42e206831aa00b77c91f20e428263b1534a1db3c2abab4915
SHA512

b62f40f4ef79a4538afa609a0e66838339c1e54e3340d917fbf2ac7e59d6b7487b4807a1f18088736963b4030c0f28de8c43b6bfc2ddd7d72235cc3a6ea05190
SSDEEP

6144:tgqUTWoodwYn0vpNnjB6SZk+L6gmo/b7EqAAwp8oXbftChXW3AxfulDGgB:DUTRoKN7nt6S2+LN/AqgpZblCJxfS6

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

323b8534996ed1f42e206831aa00b77c91f20e428263b1534a1db3c2abab4915.exe

description pid process

Token: SeDebugPrivilege 1504 323b8534996ed1f42e206831aa00b77c91f20e428263b1534a1db3c2abab4915.exe

description	pid	process
Token: SeDebugPrivilege	1504	323b8534996ed1f42e206831aa00b77c91f20e428263b1534a1db3c2abab4915.exe

C:\Users\Admin\AppData\Local\Temp\323b8534996ed1f42e206831aa00b77c91f20e428263b1534a1db3c2abab4915.exe
"C:\Users\Admin\AppData\Local\Temp\323b8534996ed1f42e206831aa00b77c91f20e428263b1534a1db3c2abab4915.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1504

memory/1504-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1504-55-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1504-59-0x0000000001EE0000-0x0000000001F65000-memory.dmp

Filesize
532KB

Download