ba8ab2c2e78b8ce9f1969d8d22578ec75da2c34b41ee010b0790e92bc0f82c65

Analysis

max time kernel
169s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 11:07

Target
ba8ab2c2e78b8ce9f1969d8d22578ec75da2c34b41ee010b0790e92bc0f82c65.exe
Size 765KB
Sample221106-m8ad6aggd5
SHA256 ba8ab2c2e78b8ce9f1969d8d22578ec75da2c34b41ee010b0790e92bc0f82c65
MD5 350212b6a9e8ced1d1a052fa7371b240
SHA1 67e7690095a3af758d241a04d8f737be10e45b48
SHA512 ba47e592fd38e5da1b4c61f5bd5575417c57148dbf389c76452d841ad49e471ed121edbd7f5b9fdbd611aeca1323ab7c1b4bc330b24deaa07fdbfe0ccc66686f
SSDEEP 12288:qoNaBGW9TO7/1fl7IS4K1qn16evHTtCwjSpA+SpPrJ28PKJ:JaBt9AQWITtfjS9SpPrQ8P
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3992	ba8ab2c2e78b8ce9f1969d8d22578ec75da2c34b41ee010b0790e92bc0f82c65.exe

C:\Users\Admin\AppData\Local\Temp\ba8ab2c2e78b8ce9f1969d8d22578ec75da2c34b41ee010b0790e92bc0f82c65.exe
"C:\Users\Admin\AppData\Local\Temp\ba8ab2c2e78b8ce9f1969d8d22578ec75da2c34b41ee010b0790e92bc0f82c65.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3992