81398f8bef9a79509d7e16ca64de1616f59db10f1d3650d90809ca22a42eac5e

Analysis

max time kernel
8s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-10-2022 06:10

Target

81398f8bef9a79509d7e16ca64de1616f59db10f1d3650d90809ca22a42eac5e.exe
Size

428KB
MD5

8428030b9554e9dd9ce63ac6be2d64d1
SHA1

0948f04d6a88d138de830f8eecd8187ab153e59b
SHA256

81398f8bef9a79509d7e16ca64de1616f59db10f1d3650d90809ca22a42eac5e
SHA512

c6f2d42e1615f3647f02092bade80572d28f202af06b425b019075e6891b486a897486995962607f945e1dea0bbcd18faca42de9b594199f0ef4fe2b4faa4c22
SSDEEP

6144:yAjFpeUHryppHI9kCXVuEmKxi/y8xMtoW76Oy8CUgpukeMoXbftChXW3AxfulDGq:TtHry31CXVuE53YV24wblCJxfS6

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

81398f8bef9a79509d7e16ca64de1616f59db10f1d3650d90809ca22a42eac5e.exe

description pid process

Token: SeDebugPrivilege 1976 81398f8bef9a79509d7e16ca64de1616f59db10f1d3650d90809ca22a42eac5e.exe

description	pid	process
Token: SeDebugPrivilege	1976	81398f8bef9a79509d7e16ca64de1616f59db10f1d3650d90809ca22a42eac5e.exe

C:\Users\Admin\AppData\Local\Temp\81398f8bef9a79509d7e16ca64de1616f59db10f1d3650d90809ca22a42eac5e.exe
"C:\Users\Admin\AppData\Local\Temp\81398f8bef9a79509d7e16ca64de1616f59db10f1d3650d90809ca22a42eac5e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1976

memory/1976-54-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download
memory/1976-55-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1976-59-0x00000000004B0000-0x0000000000535000-memory.dmp

Filesize
532KB

Download