7ffc71cf20cf0e0e4985b41663d03d4c12537a1d751b1d4c06cfb63ca6e61dde

Analysis

max time kernel
9s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-10-2022 05:49

Target

7ffc71cf20cf0e0e4985b41663d03d4c12537a1d751b1d4c06cfb63ca6e61dde.exe
Size

424KB
MD5

7d5a9f62895e77a67c910788d841e997
SHA1

666e0ca8ad9a45b61890ccd7fd99c84a57fc7dd6
SHA256

7ffc71cf20cf0e0e4985b41663d03d4c12537a1d751b1d4c06cfb63ca6e61dde
SHA512

274bf9344b8f51fa8fc4c75360811b8fe6dbb8c01e118a58efbabcc2fe57edab309aa41b58894d00900565be871ff59db9da320fbf4b5551f55762401b0d9e53
SSDEEP

12288:mmM+X6gSTFp6q5ePiWkO1AeV5WhtblCJxfS6:FMq6gSTLj5f5O5u5OR1

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7ffc71cf20cf0e0e4985b41663d03d4c12537a1d751b1d4c06cfb63ca6e61dde.exe

description pid process

Token: SeDebugPrivilege 836 7ffc71cf20cf0e0e4985b41663d03d4c12537a1d751b1d4c06cfb63ca6e61dde.exe

description	pid	process
Token: SeDebugPrivilege	836	7ffc71cf20cf0e0e4985b41663d03d4c12537a1d751b1d4c06cfb63ca6e61dde.exe

C:\Users\Admin\AppData\Local\Temp\7ffc71cf20cf0e0e4985b41663d03d4c12537a1d751b1d4c06cfb63ca6e61dde.exe
"C:\Users\Admin\AppData\Local\Temp\7ffc71cf20cf0e0e4985b41663d03d4c12537a1d751b1d4c06cfb63ca6e61dde.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:836

memory/836-54-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/836-55-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/836-59-0x0000000000310000-0x0000000000395000-memory.dmp

Filesize
532KB

Download