8fafee48316848ec1b12141348c06c575b3c9a64d81ca8244f3a3cd883d26de9

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
16-11-2022 16:34

Target

file.exe
Size

365KB
MD5

88ec2c8cb4672d289b98287b0190a6d2
SHA1

741d70aff1b2ea4f8ea28ebb256ccdceb67efd53
SHA256

8fafee48316848ec1b12141348c06c575b3c9a64d81ca8244f3a3cd883d26de9
SHA512

f566a015efadb710836488124df42b08d9e7663d706e05a5c88c69ea187011b7d79256221c8f84f5bfc3a55c6c2d8effd91d7dbf8f5ecb98fb34083b6050feea
SSDEEP

6144:fQ9LC5+ca1f8isriFJSsD5fYpHnqzNrB/KP6bcTXY:fi24ca10i9JSslknsT/iV

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

file.exe

description pid process

Token: SeDebugPrivilege 4632 file.exe

description	pid	process
Token: SeDebugPrivilege	4632	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4632

memory/4632-132-0x0000000000AE7000-0x0000000000B1D000-memory.dmp

Filesize
216KB

Download
memory/4632-133-0x0000000000CD0000-0x0000000000D29000-memory.dmp

Filesize
356KB

Download
memory/4632-134-0x0000000005090000-0x0000000005634000-memory.dmp

Filesize
5.6MB

Download
memory/4632-135-0x0000000005640000-0x0000000005C58000-memory.dmp

Filesize
6.1MB

Download
memory/4632-136-0x0000000005060000-0x0000000005072000-memory.dmp

Filesize
72KB

Download
memory/4632-137-0x0000000005C60000-0x0000000005D6A000-memory.dmp

Filesize
1.0MB

Download
memory/4632-138-0x0000000000400000-0x000000000085E000-memory.dmp

Filesize
4.4MB

Download
memory/4632-139-0x0000000005D70000-0x0000000005DAC000-memory.dmp

Filesize
240KB

Download
memory/4632-140-0x0000000000AE7000-0x0000000000B1D000-memory.dmp

Filesize
216KB

Download
memory/4632-141-0x0000000000CD0000-0x0000000000D29000-memory.dmp

Filesize
356KB

Download