ff3464f51f6e7fbdf1b236affdb5cb5ebcf84d56d1923e17e6bf267c6a6861a7

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2023 22:02

Target

aboutPageProcessScript.js
Size

974B
MD5

5d639848905732aa096b3692e454abea
SHA1

189956611638e80eb1d8c9d2ddca80be4221d024
SHA256

8bb9029e0978f4de804fec6b6f7fdc89b98dd80866df48d5584403d594c09798
SHA512

2fbc97d84327f49f6b3256434633968ec89750ea1362181763a21f4ab5cdd4e18841b78fd6baa249f7f29f37ab503e7d511005c9462966f19e5eca68fb5b95c0

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 4456 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	4456	svchost.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\aboutPageProcessScript.js
1⤵
PID:3388

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3912

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4456

memory/4456-0-0x000001F8ABD40000-0x000001F8ABD50000-memory.dmp

Filesize
64KB

Download
memory/4456-16-0x000001F8ABE40000-0x000001F8ABE50000-memory.dmp

Filesize
64KB

Download
memory/4456-32-0x000001F8B41A0000-0x000001F8B41A1000-memory.dmp

Filesize
4KB

Download
memory/4456-34-0x000001F8B41D0000-0x000001F8B41D1000-memory.dmp

Filesize
4KB

Download
memory/4456-35-0x000001F8B41D0000-0x000001F8B41D1000-memory.dmp

Filesize
4KB

Download
memory/4456-36-0x000001F8B42E0000-0x000001F8B42E1000-memory.dmp

Filesize
4KB

Download