60154e36818e9c1005d214c3e03f461dae4931d4aa9540821d417619602fe89a

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
31/10/2023, 13:58

Target

c7a270565e691571199b35a704391e1500ffcac35dcc688cfa29fd1f7baba0f7.exe
Size

652KB
MD5

fa148b98c2276fbb519987ea3c415939
SHA1

18f4128e7e17097e2abc10a29eba879858ba8b70
SHA256

c7a270565e691571199b35a704391e1500ffcac35dcc688cfa29fd1f7baba0f7
SHA512

bd8651d3ef0370a7abf0c352b184bf80f4da22dcf3469c1e5996000cc0ebdf46f9e40835f283bebe30c5804b96365004516613c91b63861f58d436d3d8d990b0
SSDEEP

12288:Xjp5bu9TlLfUTdwq1A0WHrP76jI+FuXCAbwXb4ieGig1h:XjvbuhZUTdMLDfP/bwRig1

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2944	c7a270565e691571199b35a704391e1500ffcac35dcc688cfa29fd1f7baba0f7.exe

C:\Users\Admin\AppData\Local\Temp\c7a270565e691571199b35a704391e1500ffcac35dcc688cfa29fd1f7baba0f7.exe
"C:\Users\Admin\AppData\Local\Temp\c7a270565e691571199b35a704391e1500ffcac35dcc688cfa29fd1f7baba0f7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2944

memory/2944-0-0x0000000000E60000-0x0000000000F0A000-memory.dmp

Filesize
680KB

Download
memory/2944-1-0x000007FEF5DA0000-0x000007FEF678C000-memory.dmp

Filesize
9.9MB

Download
memory/2944-2-0x000000001A800000-0x000000001A880000-memory.dmp

Filesize
512KB

Download
memory/2944-3-0x000000001AFD0000-0x000000001B080000-memory.dmp

Filesize
704KB

Download
memory/2944-4-0x000007FEF5DA0000-0x000007FEF678C000-memory.dmp

Filesize
9.9MB

Download