ab71ffb518f0802251257a7a5c8b107a1659d4bdaae04b1698e2079a71056c82

Analysis

max time kernel
151s
max time network
155s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 09:37

Target

ab71ffb518f0802251257a7a5c8b107a1659d4bdaae04b1698e2079a71056c82.exe
Size

950KB
MD5

99f0685b66a1378da325f746af950387
SHA1

050a5270ed025afd9c81e16ce75605bfdb945c6f
SHA256

ab71ffb518f0802251257a7a5c8b107a1659d4bdaae04b1698e2079a71056c82
SHA512

a2b8e3ffaabd2a3c373f96f4a5d817734ccc3647a23da9e4e06c6e30e0523be97c51e82719469b2fbbdd3eaa7524623a5df510a01e3de87fc974d91efc6f6f4c
SSDEEP

24576:rbhCAzc/bU6qsguxKVITWnmNwU2LIkdI31h6DnjI:rc/Y6eiKVITWnmT2LIP6Dnk

Score

7^/10

Unexpected DNS network traffic destination 13 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ab71ffb518f0802251257a7a5c8b107a1659d4bdaae04b1698e2079a71056c82.exe

description pid process

Token: SeShutdownPrivilege 1324 ab71ffb518f0802251257a7a5c8b107a1659d4bdaae04b1698e2079a71056c82.exe

description	pid	process
Token: SeShutdownPrivilege	1324	ab71ffb518f0802251257a7a5c8b107a1659d4bdaae04b1698e2079a71056c82.exe

C:\Users\Admin\AppData\Local\Temp\ab71ffb518f0802251257a7a5c8b107a1659d4bdaae04b1698e2079a71056c82.exe
"C:\Users\Admin\AppData\Local\Temp\ab71ffb518f0802251257a7a5c8b107a1659d4bdaae04b1698e2079a71056c82.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1324

memory/1324-54-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download
memory/1324-55-0x0000000002CF0000-0x0000000003CF0000-memory.dmp

Filesize
16.0MB

Download
memory/1324-56-0x0000000002CF0000-0x0000000003CF0000-memory.dmp

Filesize
16.0MB

Download