ca04eefe38697f6406b489562fc163d26f08169e18d11bb18dcb75ba713827be

Analysis

max time kernel
8s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-10-2022 00:29

Target

ca04eefe38697f6406b489562fc163d26f08169e18d11bb18dcb75ba713827be.exe
Size

428KB
MD5

bbef617aa4842cc8c85ef7dfc686239c
SHA1

e8672962fd43d169f5d375d6afaa01dd70f3b129
SHA256

ca04eefe38697f6406b489562fc163d26f08169e18d11bb18dcb75ba713827be
SHA512

24353a0d67c2782943861c11b40b8b923f99d0cefbd2ef0770b6b13fc68724a3d49cc93404b7cc5e5bb0904791905c0049d5c8ef8a0a9ef866dd06585775e74f
SSDEEP

12288:FGWf3BWLqi/f3xF7PxqViWValazc5ICyPFblCJxfS6:7BSqi/fxWiWVQqJOR1

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	900	ca04eefe38697f6406b489562fc163d26f08169e18d11bb18dcb75ba713827be.exe

C:\Users\Admin\AppData\Local\Temp\ca04eefe38697f6406b489562fc163d26f08169e18d11bb18dcb75ba713827be.exe
"C:\Users\Admin\AppData\Local\Temp\ca04eefe38697f6406b489562fc163d26f08169e18d11bb18dcb75ba713827be.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:900

memory/900-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/900-55-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/900-59-0x0000000001D50000-0x0000000001DD5000-memory.dmp

Filesize
532KB

Download