b1f38ef79742e99617096f5f5e223972c805a6006af4e29e9ae8bdee6b1a33c5

Analysis

max time kernel
8s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-10-2022 18:25

Target

b1f38ef79742e99617096f5f5e223972c805a6006af4e29e9ae8bdee6b1a33c5.exe
Size

424KB
MD5

7ff229955a92a6ad6937118bcd9c1295
SHA1

575d2346161618cde9a2ce04ea3ad762ed01fc64
SHA256

b1f38ef79742e99617096f5f5e223972c805a6006af4e29e9ae8bdee6b1a33c5
SHA512

e8ebd4a5f572ea6e20b3167cb690c5c207f7ee46d29aff5b05eb6e6baaf5ae2424fb1d73ab55f2b029b368ed9a77b3d6e0f330bf4ee57658f521522ee5e489a4
SSDEEP

6144:NWmfUHQSVs1ZYi9Cz3cnPOqURF7T16kCQ4B1oyjqnVhyfVoXbftChXW3AxfulDGq:0mfUHQS0GiGc6R6kXP/nVAcblCJxfS6

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b1f38ef79742e99617096f5f5e223972c805a6006af4e29e9ae8bdee6b1a33c5.exe

description	pid	Process
Token: SeDebugPrivilege	1956	b1f38ef79742e99617096f5f5e223972c805a6006af4e29e9ae8bdee6b1a33c5.exe

C:\Users\Admin\AppData\Local\Temp\b1f38ef79742e99617096f5f5e223972c805a6006af4e29e9ae8bdee6b1a33c5.exe
"C:\Users\Admin\AppData\Local\Temp\b1f38ef79742e99617096f5f5e223972c805a6006af4e29e9ae8bdee6b1a33c5.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1956

memory/1956-54-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/1956-55-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/1956-59-0x0000000000270000-0x00000000002F5000-memory.dmp

Filesize
532KB

Download