cc91fbac873587b0e1f48052e84d39945951d30b5ee69b51fb81c26a3f5d15a9

Analysis

max time kernel
13s
max time network
18s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:13

Target

NEAS.0b0a2bbfeb0c4b09f00f6ce63dd203b0.exe
Size

1.3MB
MD5

0b0a2bbfeb0c4b09f00f6ce63dd203b0
SHA1

a6bd1ff152fc2f0cbb827e679b7cc5bda801a0b5
SHA256

cc91fbac873587b0e1f48052e84d39945951d30b5ee69b51fb81c26a3f5d15a9
SHA512

c558450907404ebf65e844effc702c15ea452e33256a65cd373d8c0c3b44b51e42d001d43dd9eb278a5bdb4f7c2463b89e4d0621ad4fec5107ed093a151e8c2b
SSDEEP

24576:kPnsDZd8qizvrjfnmUWpEJcvTiGdtmOyggh:kPnsDZdx+TjfmF6JYTiGDm

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2816	NEAS.0b0a2bbfeb0c4b09f00f6ce63dd203b0.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.0b0a2bbfeb0c4b09f00f6ce63dd203b0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0b0a2bbfeb0c4b09f00f6ce63dd203b0.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2816

memory/2816-1-0x0000000140000000-0x0000000140201000-memory.dmp

Filesize
2.0MB

Download
memory/2816-0-0x0000000000300000-0x0000000000360000-memory.dmp

Filesize
384KB

Download
memory/2816-8-0x0000000000300000-0x0000000000360000-memory.dmp

Filesize
384KB

Download
memory/2816-10-0x0000000000300000-0x0000000000360000-memory.dmp

Filesize
384KB

Download
memory/2816-12-0x0000000140000000-0x0000000140201000-memory.dmp

Filesize
2.0MB

Download