d1cf47ff9a807482d12ecb01629261093ee4d9fac0db7998e5ff5cb90be35055

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 04:43

Target

d1cf47ff9a807482d12ecb01629261093ee4d9fac0db7998e5ff5cb90be35055.exe
Size

6.4MB
MD5

2f9fbe639ac809b13695efb99e924428
SHA1

6b3588106ea48ee378732c693ac119667fcc2d49
SHA256

d1cf47ff9a807482d12ecb01629261093ee4d9fac0db7998e5ff5cb90be35055
SHA512

66435936fae95460635b2b0411adc96b6ae92a11976d04ffeeb091c8aea6d6f4c70fd0071e8dc2fb3b673466b9cdf890f770b1cdbfa9b31bd6e5465e4611703f
SSDEEP

49152:IB5t6XV3Zrb/T+vO90d7HjmAFd4A64nsfJ5UyDnCq494smLJA9+j2ZoT16lG5EAu:p3zCqY5ZOrEeAz3jrmPBcMFSrVym5

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4928	svchost.exe

C:\Users\Admin\AppData\Local\Temp\d1cf47ff9a807482d12ecb01629261093ee4d9fac0db7998e5ff5cb90be35055.exe
"C:\Users\Admin\AppData\Local\Temp\d1cf47ff9a807482d12ecb01629261093ee4d9fac0db7998e5ff5cb90be35055.exe"
1⤵
PID:1312

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:456

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4928

memory/4928-0-0x00000189C13A0000-0x00000189C13B0000-memory.dmp

Filesize
64KB

Download
memory/4928-16-0x00000189C14A0000-0x00000189C14B0000-memory.dmp

Filesize
64KB

Download
memory/4928-32-0x00000189C9810000-0x00000189C9811000-memory.dmp

Filesize
4KB

Download
memory/4928-34-0x00000189C9840000-0x00000189C9841000-memory.dmp

Filesize
4KB

Download
memory/4928-35-0x00000189C9840000-0x00000189C9841000-memory.dmp

Filesize
4KB

Download
memory/4928-36-0x00000189C9950000-0x00000189C9951000-memory.dmp

Filesize
4KB

Download