2854d4e4cf5f08c940c23577a0d39a5f35f5c1bb7879853b9783437e3ae8d419

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/10/2022, 22:15

Target
file.exe
Size 78KB
Sample221027-159azadhdm
SHA256 2854d4e4cf5f08c940c23577a0d39a5f35f5c1bb7879853b9783437e3ae8d419
MD5 468c72d54e968e57b570537f5748b388
SHA1 4d2e743b0b9544b3dfc81616987acccab704225c
SHA512 45a537913013228901c426f23d9cdd6008be62225fb5510a5d8f6604fccd5f51de4335d0da222db6a7a49a9f5bae89918492818126c1b2829e304f87b8321f10
SSDEEP 1536:CNU+7O+rDxDpIS5wpOk3JCK6pFoSXl6fOpd/9nEh9TGMJKR:k0QwpOk5CK64O/9ESMJK
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	812	file.exe
Token: 33	812	file.exe
Token: SeIncBasePriorityPrivilege	812	file.exe
Token: 33	812	file.exe
Token: SeIncBasePriorityPrivilege	812	file.exe
Token: 33	812	file.exe
Token: SeIncBasePriorityPrivilege	812	file.exe
Token: 33	812	file.exe
Token: SeIncBasePriorityPrivilege	812	file.exe
Token: 33	812	file.exe
Token: SeIncBasePriorityPrivilege	812	file.exe
Token: 33	812	file.exe
Token: SeIncBasePriorityPrivilege	812	file.exe
Token: 33	812	file.exe
Token: SeIncBasePriorityPrivilege	812	file.exe
Token: 33	812	file.exe
Token: SeIncBasePriorityPrivilege	812	file.exe
Token: 33	812	file.exe
Token: SeIncBasePriorityPrivilege	812	file.exe
Token: 33	812	file.exe
Token: SeIncBasePriorityPrivilege	812	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:812

memory/812-54-0x0000000075131000-0x0000000075133000-memory.dmp

Download

memory/812-55-0x0000000073FA0000-0x000000007454B000-memory.dmp

Download

memory/812-56-0x0000000073FA0000-0x000000007454B000-memory.dmp

Download