2fe936d6b25266ad008ffe359931fc537bfbc3f00774af009c2de5f3abb04e1c

Analysis

max time kernel
111s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28-01-2023 03:12

Target

Redline_20_2_crack/Kurome.Host/Kurome.Host.exe
Size

119KB
MD5

4fde0f80c408af27a8d3ddeffea12251
SHA1

e834291127af150ce287443c5ea607a7ae337484
SHA256

1b644cdb1c7247c07d810c0ea10bec34dc5600f3645589690a219de08cf2dedb
SHA512

3693aeaa2cc276060b899f21f6f57f435b75fec5bcd7725b2dd79043b341c12ebc29bd43b287eb22a3e31fd2b50c4fa36bf020f9f3db5e2f75fe8cc747eca5f5
SSDEEP

3072:KEdjrOO8+K46SgVE+mxzqT67iLRi/Gj81GUpYb:KjQjgPmxzq27iLRiuAPp

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Kurome.Host.exe

description pid process

Token: SeDebugPrivilege 2824 Kurome.Host.exe

description	pid	process
Token: SeDebugPrivilege	2824	Kurome.Host.exe

C:\Users\Admin\AppData\Local\Temp\Redline_20_2_crack\Kurome.Host\Kurome.Host.exe
"C:\Users\Admin\AppData\Local\Temp\Redline_20_2_crack\Kurome.Host\Kurome.Host.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2824

memory/2824-132-0x0000000000BA0000-0x0000000000BC4000-memory.dmp

Filesize
144KB

Download
memory/2824-133-0x00000000053A0000-0x00000000053C6000-memory.dmp

Filesize
152KB

Download
memory/2824-134-0x0000000005C20000-0x0000000006238000-memory.dmp

Filesize
6.1MB

Download
memory/2824-135-0x0000000005480000-0x0000000005492000-memory.dmp

Filesize
72KB

Download
memory/2824-136-0x0000000005580000-0x00000000055BC000-memory.dmp

Filesize
240KB

Download
memory/2824-137-0x00000000056D0000-0x000000000579E000-memory.dmp

Filesize
824KB

Download
memory/2824-138-0x00000000058B0000-0x00000000059BA000-memory.dmp

Filesize
1.0MB

Download
memory/2824-139-0x0000000005630000-0x0000000005658000-memory.dmp

Filesize
160KB

Download
memory/2824-140-0x00000000057A0000-0x00000000057F0000-memory.dmp

Filesize
320KB

Download