ec6df713446a8dd5efb376fbb7b444ed7e09f5cdd98c0494999b64af2e2d5537

Analysis

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20230220-de
resource tags

arch:x64arch:x86image:win7-20230220-delocale:de-deos:windows7-x64systemwindows
submitted
01-04-2023 12:29

Target

krnl_beta.exe
Size

1.8MB
MD5

3701dc535fb395d6a1fb557a3aeec5e9
SHA1

ef517659229ddc6ecfc02481c3953ac9322dae35
SHA256

ec6df713446a8dd5efb376fbb7b444ed7e09f5cdd98c0494999b64af2e2d5537
SHA512

20dc14387138f913034bd2c265156dca1f36c128c040a99d6904fe6f1830d2f98afb3dcf0553817adb66e480be7d0fb0d7df58f0feb9b007a5a6bab648b081a2
SSDEEP

49152:+P1uB0SVp4+KSxyrRUzS65+x+rnxYr9PC:+Pk0ST4+RgRUzS65+x1ZPC

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

krnl_beta.exe

description pid process

Token: SeDebugPrivilege 1252 krnl_beta.exe

description	pid	process
Token: SeDebugPrivilege	1252	krnl_beta.exe

C:\Users\Admin\AppData\Local\Temp\krnl_beta.exe
"C:\Users\Admin\AppData\Local\Temp\krnl_beta.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1252

memory/1252-54-0x0000000000F60000-0x000000000113A000-memory.dmp

Filesize
1.9MB

Download
memory/1252-55-0x0000000004D90000-0x0000000004DD0000-memory.dmp

Filesize
256KB

Download
memory/1252-56-0x0000000000410000-0x000000000041A000-memory.dmp

Filesize
40KB

Download
memory/1252-57-0x0000000004D90000-0x0000000004DD0000-memory.dmp

Filesize
256KB

Download
memory/1252-59-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/1252-58-0x0000000004D90000-0x0000000004DD0000-memory.dmp

Filesize
256KB

Download
memory/1252-60-0x0000000004D90000-0x0000000004DD0000-memory.dmp

Filesize
256KB

Download
memory/1252-61-0x0000000004D90000-0x0000000004DD0000-memory.dmp

Filesize
256KB

Download
memory/1252-62-0x0000000004D90000-0x0000000004DD0000-memory.dmp

Filesize
256KB

Download