f7bab685eb74130f2e49156071fe2522134b3650d372ead79743f810d6e9051e

Analysis

max time kernel
414s
max time network
562s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 19:37

Target

HearthCrawler_R30_10/Hearthcrawler.Agent.exe
Size

224KB
MD5

75b055ad06dd614b0a7a8031524c2848
SHA1

12d425544c2c4aa143b9ffb57f9acad8e7cd0b5c
SHA256

c234e40256be5e65028324c35fadc71cc59aa57ec678972b91ebc7f1e7f4c760
SHA512

34a67cf8ca9685f996ed6c1908957198b989217439dd0a6a818598d9986073e4020e3949e954e4bf277b65c0ddddb299e7f200bdcac355471fa7c22988387bec
SSDEEP

3072:j1fQkD/67HT1fQkD/67HRfUlk2YeqOkGT0tq0H/lz3+1fQkD/67H:jVQJ7zVQJ7xfUOdjGTyqK6VQJ7

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Hearthcrawler.Agent.exe

description pid process

Token: SeDebugPrivilege 1840 Hearthcrawler.Agent.exe

description	pid	process
Token: SeDebugPrivilege	1840	Hearthcrawler.Agent.exe

C:\Users\Admin\AppData\Local\Temp\HearthCrawler_R30_10\Hearthcrawler.Agent.exe
"C:\Users\Admin\AppData\Local\Temp\HearthCrawler_R30_10\Hearthcrawler.Agent.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1840

memory/1840-54-0x00000000013D0000-0x000000000140E000-memory.dmp

Filesize
248KB

Download
memory/1840-55-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/1840-56-0x0000000004965000-0x0000000004976000-memory.dmp

Filesize
68KB

Download