dd8d30002672ae69950a9bcd51419c3cc3820fc208da56275b44d64e4cd2dc8a

Analysis

max time kernel
207s
max time network
216s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 02:54

Target

dd8d30002672ae69950a9bcd51419c3cc3820fc208da56275b44d64e4cd2dc8a.exe
Size

3.3MB
MD5

ee287aa99242ca4931361fdc451d663a
SHA1

60d61fbd7339f2f0aae5b5e9e68f452868b5f878
SHA256

dd8d30002672ae69950a9bcd51419c3cc3820fc208da56275b44d64e4cd2dc8a
SHA512

9876c2b5383a11dcf7b357667cfd12a8a7f43262c95e5bcca2d9ab802fc69a90699b42577e4610b95541f00383b39f6800b5c971e4973d432c1c2a6dd5d07318
SSDEEP

98304:Fi1YKh5EC+AhIddIB4jlstgKr5NQLtD6aF:LKhuC3addIBRBrPQLs4

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	dd8d30002672ae69950a9bcd51419c3cc3820fc208da56275b44d64e4cd2dc8a.exe

C:\Users\Admin\AppData\Local\Temp\dd8d30002672ae69950a9bcd51419c3cc3820fc208da56275b44d64e4cd2dc8a.exe
"C:\Users\Admin\AppData\Local\Temp\dd8d30002672ae69950a9bcd51419c3cc3820fc208da56275b44d64e4cd2dc8a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5040