d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0

Analysis

max time kernel
186s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 18:26

Target

d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe
Size

237KB
MD5

d3588affd317d7994a8a1488437aa951
SHA1

f35b3ecb788187b811b66db394a3bdb59fe68152
SHA256

d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0
SHA512

ee50fcb6d8ade03f2ebf50e1784e2a50b5bccc23b67ffd33d7fe6fd77a75d4a70dc0bc4a2ee781bdb284e996f2c663ca52f8b2bb284503e28c75e55e76daa9d5
SSDEEP

768:VXi9Z3uVe/5zq5LrP0DyRyRwXC1CKlGlR5BcBhfOpRvX85QywGkFESH9EaCUn1dP:Vg/5zKLrcDU0wyUKALYhfOOg

Score

1^/10

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe

description	pid	process
Token: SeDebugPrivilege	384	d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe
Token: 33	384	d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe
Token: SeIncBasePriorityPrivilege	384	d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe

C:\Users\Admin\AppData\Local\Temp\d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe
"C:\Users\Admin\AppData\Local\Temp\d63027d7ab640b68ed2ec91e8bb3c45758ddcfa4f235bbb47fb2aea66c5d1db0.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:384

memory/384-132-0x0000000000280000-0x00000000002C2000-memory.dmp

Filesize
264KB

Download
memory/384-133-0x0000000004C20000-0x0000000004CBC000-memory.dmp

Filesize
624KB

Download
memory/384-134-0x0000000005510000-0x0000000005AB4000-memory.dmp

Filesize
5.6MB

Download
memory/384-135-0x0000000000C30000-0x0000000000CC2000-memory.dmp

Filesize
584KB

Download
memory/384-136-0x0000000000B90000-0x0000000000B9A000-memory.dmp

Filesize
40KB

Download
memory/384-137-0x0000000005150000-0x00000000051B6000-memory.dmp

Filesize
408KB

Download