d5c7c3f5d8a3cb6ec5b4f05dc18ddf1591544be8007cb17dbcb11d98701cfb1d

Analysis

max time kernel
164s
max time network
176s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 18:27

Target

NEAS.d5c7c3f5d8a3cb6ec5b4f05dc18ddf1591544be8007cb17dbcb11d98701cfb1dexe_JC.exe
Size

1.4MB
MD5

d2105231b50a87133f07d340d30711ea
SHA1

a933024e21d0792033ead30b1c72a5b243688595
SHA256

d5c7c3f5d8a3cb6ec5b4f05dc18ddf1591544be8007cb17dbcb11d98701cfb1d
SHA512

80539fb6c7a731111b923fd226c02022b929476eddca02f8df8cd9695e99aad3dcd1c6606e65c2559643333d183fa6864c75c9dd05a9acc81348c2ca8716b825
SSDEEP

24576:JTZ9M31t0GtNco35IvemcWv1YL57PWNEjlcd7bjgpgVeHqj:39M31t0qHpgVeo

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2408	NEAS.d5c7c3f5d8a3cb6ec5b4f05dc18ddf1591544be8007cb17dbcb11d98701cfb1dexe_JC.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.d5c7c3f5d8a3cb6ec5b4f05dc18ddf1591544be8007cb17dbcb11d98701cfb1dexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.d5c7c3f5d8a3cb6ec5b4f05dc18ddf1591544be8007cb17dbcb11d98701cfb1dexe_JC.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2408

memory/2408-0-0x0000000000350000-0x00000000004C0000-memory.dmp

Filesize
1.4MB

Download
memory/2408-1-0x00000000748F0000-0x0000000074FDE000-memory.dmp

Filesize
6.9MB

Download
memory/2408-2-0x0000000000760000-0x00000000007A0000-memory.dmp

Filesize
256KB

Download
memory/2408-3-0x00000000748F0000-0x0000000074FDE000-memory.dmp

Filesize
6.9MB

Download
memory/2408-4-0x0000000000760000-0x00000000007A0000-memory.dmp

Filesize
256KB

Download