b6269018ac32484bdc093a6bec324fc9aa7990104a297f55600d31bff95ed6fd

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2023 16:15

Target

i1v/zN/JI/eWJM/MVst/qI/1Q52/uURq/QIPJ/J4Xw/J6V/CO/bOs8/GMV/N53B/bootim.exe
Size

26KB
MD5

9e65f3bf408cc580bed4ecb0d91ac58d
SHA1

1d0ecff74bbc4f1a56583773492198a84546f105
SHA256

99660e380163afbf4d66341364909f904e9695ba2872b5dc1df575498d2bd344
SHA512

dacc80ff162de5f818334c9ed6ed988459fb11caab99bc27a1b03251d2e582a425e6d93a94ac21b68b58fa7b18bfe2b75c92c1497439073a2632907b5768b719
SSDEEP

768:pq9FtEU+i2u88EoO7nwF2IDec322GBwQB:8pUuBqwFLec5GBwQB

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemEnvironmentPrivilege	2844	bootim.exe

C:\Users\Admin\AppData\Local\Temp\i1v\zN\JI\eWJM\MVst\qI\1Q52\uURq\QIPJ\J4Xw\J6V\CO\bOs8\GMV\N53B\bootim.exe
"C:\Users\Admin\AppData\Local\Temp\i1v\zN\JI\eWJM\MVst\qI\1Q52\uURq\QIPJ\J4Xw\J6V\CO\bOs8\GMV\N53B\bootim.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2844