22bfaa619da4ca334464ce8d0a61102d6bc2682fc5b0415bad7891bb4c5315c9

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2023, 18:06

Target

22bfaa619da4ca334464ce8d0a61102d6bc2682fc5b0415bad7891bb4c5315c9.exe
Size

388KB
MD5

bb89bb00b36ae9f769c6ac13fb2d934f
SHA1

e898c639913c202ec2f9b4b263d7bb5703f89416
SHA256

22bfaa619da4ca334464ce8d0a61102d6bc2682fc5b0415bad7891bb4c5315c9
SHA512

5504bf7ed7af385d90dfe3250af855f0750afd9dc7ead025945f17605ac31da738fe823b0d69175f6e8f0d42b11634b89bc4c824cf1caa83f42366a907229de4
SSDEEP

6144:aI7/GMOxIQJZKQvwAOW9b0VumfhxdEYmibMbabRjYkjrUt:RG3xIQJZKYjN9bc3fhxXFx5O

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1120	svchost.exe

C:\Users\Admin\AppData\Local\Temp\22bfaa619da4ca334464ce8d0a61102d6bc2682fc5b0415bad7891bb4c5315c9.exe
"C:\Users\Admin\AppData\Local\Temp\22bfaa619da4ca334464ce8d0a61102d6bc2682fc5b0415bad7891bb4c5315c9.exe"
1⤵
PID:4840

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1120

memory/1120-0-0x00000200ABC70000-0x00000200ABC80000-memory.dmp

Filesize
64KB

Download
memory/1120-16-0x00000200ABD70000-0x00000200ABD80000-memory.dmp

Filesize
64KB

Download
memory/1120-32-0x00000200B40E0000-0x00000200B40E1000-memory.dmp

Filesize
4KB

Download
memory/1120-34-0x00000200B4110000-0x00000200B4111000-memory.dmp

Filesize
4KB

Download
memory/1120-35-0x00000200B4110000-0x00000200B4111000-memory.dmp

Filesize
4KB

Download
memory/1120-36-0x00000200B4220000-0x00000200B4221000-memory.dmp

Filesize
4KB

Download