c704efe7c23661b448713dd573999023d9d729a16da659cde648297484b827ab

Analysis

max time kernel
8s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-10-2022 23:51

Target

c704efe7c23661b448713dd573999023d9d729a16da659cde648297484b827ab.exe
Size

424KB
MD5

51b36dc6c3c23b77aa2955f374b3e155
SHA1

d9d7282b349cfb23d1115c9eed0d0458952d7d00
SHA256

c704efe7c23661b448713dd573999023d9d729a16da659cde648297484b827ab
SHA512

58814cdd42bdb698f1d02aa425dbe22643f89dc4836db3a8f385a698b4a6e598d037aff7b776b598fc71295317bbd613ad0a8a91050c331a21e281fa3521d154
SSDEEP

6144:8sPAYJDo2magV+8GUEmGM41DwAHQmjdN1AUL0yogLpWPoXbftChXW3AxfulDGgB:Xp808fEmLqDwAJjpA+E+blCJxfS6

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c704efe7c23661b448713dd573999023d9d729a16da659cde648297484b827ab.exe

description pid process

Token: SeDebugPrivilege 1048 c704efe7c23661b448713dd573999023d9d729a16da659cde648297484b827ab.exe

description	pid	process
Token: SeDebugPrivilege	1048	c704efe7c23661b448713dd573999023d9d729a16da659cde648297484b827ab.exe

C:\Users\Admin\AppData\Local\Temp\c704efe7c23661b448713dd573999023d9d729a16da659cde648297484b827ab.exe
"C:\Users\Admin\AppData\Local\Temp\c704efe7c23661b448713dd573999023d9d729a16da659cde648297484b827ab.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1048

memory/1048-54-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1048-55-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1048-59-0x0000000001E60000-0x0000000001EE5000-memory.dmp

Filesize
532KB

Download