7a5638513dc1d4100a3fa051e560978668ae1f2636f874779d75d121d5eb5ba8

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2022 09:52

Target

file.exe
Size

330KB
MD5

a7b5a6ae4bbb305bbbfe761e3b2b42a1
SHA1

ca0f73dda17ae8de8cdc984bf47d2480dbb3c382
SHA256

7a5638513dc1d4100a3fa051e560978668ae1f2636f874779d75d121d5eb5ba8
SHA512

22ac8db15b76ad194c467b33fc02f5f2ee4bf7291257402f4b10bd7d1b7d2fcc7127a222439b2e9573d727cc211b4ba4c6aa64689bad07fbdb2e5ed55364b2b1
SSDEEP

6144:+uFH77Ry0fMq7VglkyzYzV3T7rTyRCdCVqT+nPQQSLopK:+ohN1RglwR7rTqCgPfOe

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

file.exe

description pid process

Token: SeDebugPrivilege 4112 file.exe

description	pid	process
Token: SeDebugPrivilege	4112	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4112

memory/4112-132-0x00000000006E9000-0x0000000000720000-memory.dmp

Filesize
220KB

Download
memory/4112-133-0x00000000022F0000-0x0000000002349000-memory.dmp

Filesize
356KB

Download
memory/4112-134-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/4112-135-0x0000000004CF0000-0x0000000005294000-memory.dmp

Filesize
5.6MB

Download
memory/4112-136-0x00000000052F0000-0x0000000005908000-memory.dmp

Filesize
6.1MB

Download
memory/4112-137-0x00000000059A0000-0x00000000059B2000-memory.dmp

Filesize
72KB

Download
memory/4112-138-0x00000000059C0000-0x0000000005ACA000-memory.dmp

Filesize
1.0MB

Download
memory/4112-139-0x0000000005AD0000-0x0000000005B0C000-memory.dmp

Filesize
240KB

Download
memory/4112-140-0x00000000006E9000-0x0000000000720000-memory.dmp

Filesize
220KB

Download