71f130b3b7f422e747fbc4bc38d3ffd3b89000d6fc1325e439f7c18c88fd1b16

Analysis

max time kernel
38s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 15:41

Target

71f130b3b7f422e747fbc4bc38d3ffd3b89000d6fc1325e439f7c18c88fd1b16.exe
Size

456KB
MD5

83703f67f59a031ba34e1f4da2d11d20
SHA1

f020904d03c2e1335b492fbfd930cc4dc61526bd
SHA256

71f130b3b7f422e747fbc4bc38d3ffd3b89000d6fc1325e439f7c18c88fd1b16
SHA512

7d111bd4f24826b220838d71bc64e5fab2d72c5532c394eb1f4ffac0472b9ae654395b40374a5ad453a56488761b2595f04b72460b6c79f4c0b020483e9cdf99
SSDEEP

12288:0iUyxbjD6A5sqdRUcdvP9j581efYj5ctrmIi:vl5z1dvP9j58gQFctCIi

Score

1^/10

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	71f130b3b7f422e747fbc4bc38d3ffd3b89000d6fc1325e439f7c18c88fd1b16.exe
Token: 33	1976	71f130b3b7f422e747fbc4bc38d3ffd3b89000d6fc1325e439f7c18c88fd1b16.exe
Token: SeIncBasePriorityPrivilege	1976	71f130b3b7f422e747fbc4bc38d3ffd3b89000d6fc1325e439f7c18c88fd1b16.exe

C:\Users\Admin\AppData\Local\Temp\71f130b3b7f422e747fbc4bc38d3ffd3b89000d6fc1325e439f7c18c88fd1b16.exe
"C:\Users\Admin\AppData\Local\Temp\71f130b3b7f422e747fbc4bc38d3ffd3b89000d6fc1325e439f7c18c88fd1b16.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1976

memory/1976-54-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download
memory/1976-55-0x0000000074120000-0x00000000746CB000-memory.dmp

Filesize
5.7MB

Download
memory/1976-56-0x0000000074120000-0x00000000746CB000-memory.dmp

Filesize
5.7MB

Download