5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097

Analysis

max time kernel
310s
max time network
331s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 12:48

Target

5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe
Size

556KB
MD5

e866034515b719467290d53f5919d599
SHA1

8cab0abfaaa087630930df86c8e25d5c9123dc75
SHA256

5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097
SHA512

a2601cfe472869b73fcec91aa03263ad74e49f2862d5dd22256376acf5002102c4f197a74116ebdafdd95744bf3c57a436c6a2e1850cf85351c3a9aafa48319d
SSDEEP

6144:Kd5DMAYloj1/L8YEAQwgG5hUQf+a/07WbvW17ZdhG3uK1gSySxfcph:Kd5DMAzjN4YEAFdmaM6UjhCu+gSeph

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe

description pid process

Token: SeDebugPrivilege 3276 5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe

description	pid	process
Token: SeDebugPrivilege	3276	5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe

C:\Users\Admin\AppData\Local\Temp\5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe
"C:\Users\Admin\AppData\Local\Temp\5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3276

memory/3276-132-0x0000000000BC0000-0x0000000000C50000-memory.dmp

Filesize
576KB

Download
memory/3276-133-0x0000000005C90000-0x0000000006234000-memory.dmp

Filesize
5.6MB

Download
memory/3276-134-0x00000000056E0000-0x0000000005772000-memory.dmp

Filesize
584KB

Download
memory/3276-135-0x0000000005780000-0x000000000581C000-memory.dmp

Filesize
624KB

Download