8f236eac10488a8498785458219778998a29433fd1a2ff0b98ccbb9d7cc9ed0d

Analysis

max time kernel
8s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-10-2022 09:26

Target

8f236eac10488a8498785458219778998a29433fd1a2ff0b98ccbb9d7cc9ed0d.exe
Size

424KB
MD5

e384658bd4a76b34bc458f25c064a99c
SHA1

89b61393358caee1c2b834b8947d5fa1145df352
SHA256

8f236eac10488a8498785458219778998a29433fd1a2ff0b98ccbb9d7cc9ed0d
SHA512

0191c95252a83c477b43ded6484ff7aed2fa86fa95b2c6065abfe22e1312ce85e4bde7afe7704f913bf5290b7eda9e104987f91d1373a1272776aa196b02556d
SSDEEP

12288:Q8DHMRGy57LfvdOkoy3ATY5r4TblCJxfS6:Q8IT9FOGrwOR1

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8f236eac10488a8498785458219778998a29433fd1a2ff0b98ccbb9d7cc9ed0d.exe

description	pid	Process
Token: SeDebugPrivilege	988	8f236eac10488a8498785458219778998a29433fd1a2ff0b98ccbb9d7cc9ed0d.exe

C:\Users\Admin\AppData\Local\Temp\8f236eac10488a8498785458219778998a29433fd1a2ff0b98ccbb9d7cc9ed0d.exe
"C:\Users\Admin\AppData\Local\Temp\8f236eac10488a8498785458219778998a29433fd1a2ff0b98ccbb9d7cc9ed0d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:988

memory/988-54-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download
memory/988-55-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/988-59-0x00000000004B0000-0x0000000000535000-memory.dmp

Filesize
532KB

Download