3b44da4b9b353b9fbd7301dc6e39bf71c79495081d4bc7ec6cb0be284c6cee60

Analysis

max time kernel
122s
max time network
150s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 21:42

Target

3b44da4b9b353b9fbd7301dc6e39bf71c79495081d4bc7ec6cb0be284c6cee60.exe
Size

1.4MB
MD5

405548768d54a5e3d5a8e0dc8e9dcd8f
SHA1

5fb2fea010f6c2ece53137c600aa91a7213e36e1
SHA256

3b44da4b9b353b9fbd7301dc6e39bf71c79495081d4bc7ec6cb0be284c6cee60
SHA512

c41e5fa5e090cb6505dc9e84e64269cc4fa0f0fd877499234fdae385d25f3a8d5bcce2e10a79cdb9a00df6422174d9311d96b5e20edcb4cb4665d38b1afdae18
SSDEEP

24576:gaCJBOF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gaCHOFLNiXicJFFRGNzj3

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2928	3b44da4b9b353b9fbd7301dc6e39bf71c79495081d4bc7ec6cb0be284c6cee60.exe

C:\Users\Admin\AppData\Local\Temp\3b44da4b9b353b9fbd7301dc6e39bf71c79495081d4bc7ec6cb0be284c6cee60.exe
"C:\Users\Admin\AppData\Local\Temp\3b44da4b9b353b9fbd7301dc6e39bf71c79495081d4bc7ec6cb0be284c6cee60.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2928

memory/2928-0-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download
memory/2928-1-0x00000000002F0000-0x0000000000356000-memory.dmp

Filesize
408KB

Download
memory/2928-6-0x00000000002F0000-0x0000000000356000-memory.dmp

Filesize
408KB

Download
memory/2928-10-0x0000000000400000-0x000000000060F000-memory.dmp

Filesize
2.1MB

Download