2fe936d6b25266ad008ffe359931fc537bfbc3f00774af009c2de5f3abb04e1c

Analysis

max time kernel
37s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-01-2023 03:12

Target

Redline_20_2_crack/Kurome.Host/Kurome.Host.exe
Size

119KB
MD5

4fde0f80c408af27a8d3ddeffea12251
SHA1

e834291127af150ce287443c5ea607a7ae337484
SHA256

1b644cdb1c7247c07d810c0ea10bec34dc5600f3645589690a219de08cf2dedb
SHA512

3693aeaa2cc276060b899f21f6f57f435b75fec5bcd7725b2dd79043b341c12ebc29bd43b287eb22a3e31fd2b50c4fa36bf020f9f3db5e2f75fe8cc747eca5f5
SSDEEP

3072:KEdjrOO8+K46SgVE+mxzqT67iLRi/Gj81GUpYb:KjQjgPmxzq27iLRiuAPp

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Kurome.Host.exe

description pid process

Token: SeDebugPrivilege 1116 Kurome.Host.exe

description	pid	process
Token: SeDebugPrivilege	1116	Kurome.Host.exe

C:\Users\Admin\AppData\Local\Temp\Redline_20_2_crack\Kurome.Host\Kurome.Host.exe
"C:\Users\Admin\AppData\Local\Temp\Redline_20_2_crack\Kurome.Host\Kurome.Host.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1116

memory/1116-54-0x00000000003F0000-0x0000000000414000-memory.dmp

Filesize
144KB

Download
memory/1116-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1116-56-0x00000000002A0000-0x00000000002C6000-memory.dmp

Filesize
152KB

Download