7d50b7c066565f1890c4195364429381a58ccb6f14896f2eb8c20fc9fbc8ded6

Analysis

max time kernel
7s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-10-2022 04:42

Target

7d50b7c066565f1890c4195364429381a58ccb6f14896f2eb8c20fc9fbc8ded6.exe
Size

360KB
MD5

8db6d3fbe634d9fcf41f15400d1f343c
SHA1

bd3b9ca039850d187da1642121362ab743cf4f57
SHA256

7d50b7c066565f1890c4195364429381a58ccb6f14896f2eb8c20fc9fbc8ded6
SHA512

c671f3d4e95cb8984e185f628e1b47d639473747598037021de420ec2d0cfeafb95e22d3993782a0568e7b7776ef68d7bb02636cfdac296c2c70f4a8ca93630b
SSDEEP

6144:NtILdB9ojzO5uGer3GiNRmoVyQEMOrAixeQzuorZ3P:LKOPO5uRlAQ+z5FP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7d50b7c066565f1890c4195364429381a58ccb6f14896f2eb8c20fc9fbc8ded6.exe

description pid process

Token: SeDebugPrivilege 1884 7d50b7c066565f1890c4195364429381a58ccb6f14896f2eb8c20fc9fbc8ded6.exe

description	pid	process
Token: SeDebugPrivilege	1884	7d50b7c066565f1890c4195364429381a58ccb6f14896f2eb8c20fc9fbc8ded6.exe

C:\Users\Admin\AppData\Local\Temp\7d50b7c066565f1890c4195364429381a58ccb6f14896f2eb8c20fc9fbc8ded6.exe
"C:\Users\Admin\AppData\Local\Temp\7d50b7c066565f1890c4195364429381a58ccb6f14896f2eb8c20fc9fbc8ded6.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1884

memory/1884-54-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/1884-55-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1884-59-0x0000000000310000-0x0000000000396000-memory.dmp

Filesize
536KB

Download