e36ab403a93fa5fb2240b954060f97e9cf38a459aab59cd173bfc7b5bbbfd2ce

Analysis

max time kernel
25s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/05/2023, 12:34

Target
IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)/dbgsrv/win32_remote.exe
Size 713KB
Sample230506-pr95kabd6y
SHA256 4d0782fac17baa4b91c8ec36b2d28398656f9fbd858135be2d418323c1c6648f
MD5 ed16388d2796c93b705d6f4c98f16259
SHA1 b546c201eb04d4ffdd9dd02d0925d7667b286541
SHA512 ec9060adcfe0a3a9db19692f5f88402838cc6f5a286b34124c38cc9cf6ee45bc57dacedb9f432f5a705040d3af442fe27b02ac23da73452bec8c39cb93022274
SSDEEP 12288:riygK09BFg1M7J8JjBGYaRCCm0qPZwtY6CpJg4Kg+3PuK3JhJ6LaT/D270gFU:rafOCmzwtY1EfuK3f8LaTb8P
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1792	win32_remote.exe

C:\Users\Admin\AppData\Local\Temp\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\dbgsrv\win32_remote.exe
"C:\Users\Admin\AppData\Local\Temp\IDA Pro 7.7.220118 (Windows) (x86,x64,ARM64)\dbgsrv\win32_remote.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1792