aa516e398bda03faafdb7b129d8ab9261b64c26c9b9e4acc0aa7eb2899f1beb7

Analysis

max time kernel
8s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-10-2022 16:26

Target

aa516e398bda03faafdb7b129d8ab9261b64c26c9b9e4acc0aa7eb2899f1beb7.exe
Size

428KB
MD5

0b23d4fb182a5b4a11cffabe59346ebb
SHA1

060c3991d04379ab5e2d7ba3e743c37c08f33efc
SHA256

aa516e398bda03faafdb7b129d8ab9261b64c26c9b9e4acc0aa7eb2899f1beb7
SHA512

ea82eb72a954c718a36acde103340a2023f450d7680e866bc9dcac8ad544f880ecb0616264b8e855fb72cb562012c46816c7521446d47df4d4fd27953c50ae4b
SSDEEP

12288:CzUgz5mSAKNuYH+eCGdFCWhLblCJxfS6:CzUOpQYeeCoFhvOR1

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

aa516e398bda03faafdb7b129d8ab9261b64c26c9b9e4acc0aa7eb2899f1beb7.exe

description pid process

Token: SeDebugPrivilege 904 aa516e398bda03faafdb7b129d8ab9261b64c26c9b9e4acc0aa7eb2899f1beb7.exe

description	pid	process
Token: SeDebugPrivilege	904	aa516e398bda03faafdb7b129d8ab9261b64c26c9b9e4acc0aa7eb2899f1beb7.exe

C:\Users\Admin\AppData\Local\Temp\aa516e398bda03faafdb7b129d8ab9261b64c26c9b9e4acc0aa7eb2899f1beb7.exe
"C:\Users\Admin\AppData\Local\Temp\aa516e398bda03faafdb7b129d8ab9261b64c26c9b9e4acc0aa7eb2899f1beb7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:904

memory/904-54-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download
memory/904-55-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/904-59-0x0000000001E60000-0x0000000001EE5000-memory.dmp

Filesize
532KB

Download