a4e2cd01d98d9ae848f2ff4a03f64978961c6ad62413698fd48613dacf557dea

Analysis

max time kernel
8s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-10-2022 15:03

Target

a4e2cd01d98d9ae848f2ff4a03f64978961c6ad62413698fd48613dacf557dea.exe
Size

424KB
MD5

416f169b4d316eb3f52682ceba73cbdb
SHA1

164f6ddfa7be987bb116269c22a30f26989e9721
SHA256

a4e2cd01d98d9ae848f2ff4a03f64978961c6ad62413698fd48613dacf557dea
SHA512

054c5e151d97d60cda1e9ee88d1eb275f3f30302ad0f171e404b48f233e551f83afc27995ac2e1ef6eed6c87fb91ccf1de8889401b2327189b859609a43f6577
SSDEEP

12288:WmM+X6gSTFp6q5ePiWkO1AeV5WhtblCJxfS6:1Mq6gSTLj5f5O5u5OR1

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a4e2cd01d98d9ae848f2ff4a03f64978961c6ad62413698fd48613dacf557dea.exe

description	pid	Process
Token: SeDebugPrivilege	1880	a4e2cd01d98d9ae848f2ff4a03f64978961c6ad62413698fd48613dacf557dea.exe

C:\Users\Admin\AppData\Local\Temp\a4e2cd01d98d9ae848f2ff4a03f64978961c6ad62413698fd48613dacf557dea.exe
"C:\Users\Admin\AppData\Local\Temp\a4e2cd01d98d9ae848f2ff4a03f64978961c6ad62413698fd48613dacf557dea.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1880

memory/1880-54-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1880-55-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1880-59-0x0000000000520000-0x00000000005A5000-memory.dmp

Filesize
532KB

Download