a3f43aefbc2cd548b34e5c42fc7315ddd80d8977d59316f22004b1c13f8eae54

Analysis

max time kernel
146s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 18:08

Target

a3f43aefbc2cd548b34e5c42fc7315ddd80d8977d59316f22004b1c13f8eae54.exe
Size

29KB
MD5

7b1599d0f9def8fccbc17a3c4f079ac0
SHA1

54d3ae3d9655487949695ab4c52da9852e26782a
SHA256

a3f43aefbc2cd548b34e5c42fc7315ddd80d8977d59316f22004b1c13f8eae54
SHA512

bc672d793a0d739b74a35ebe7429cc4ba31dabc712584b7dc574953f87cdbbcc4f77c109d27ea31aa7dcaf5891bebedadeac03d37c98faaa9df77883c6ceeb25
SSDEEP

384:10Jk8FlMlqcwcIZKHPvFc+x3SI8uhFm+3vqRMhnK9qrCn90SGwA:6iAIwWvagZLr5hKkOnCL

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a3f43aefbc2cd548b34e5c42fc7315ddd80d8977d59316f22004b1c13f8eae54.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1992	a3f43aefbc2cd548b34e5c42fc7315ddd80d8977d59316f22004b1c13f8eae54.exe
Token: SeRestorePrivilege	1992	a3f43aefbc2cd548b34e5c42fc7315ddd80d8977d59316f22004b1c13f8eae54.exe

C:\Users\Admin\AppData\Local\Temp\a3f43aefbc2cd548b34e5c42fc7315ddd80d8977d59316f22004b1c13f8eae54.exe
"C:\Users\Admin\AppData\Local\Temp\a3f43aefbc2cd548b34e5c42fc7315ddd80d8977d59316f22004b1c13f8eae54.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1992