7796753a59f4a3d67e54f5430fb3bc638846f5d2f7b5c649b06201bcb3a3f46e

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2023, 15:05

Target

StartAllBack3.6.15.4724_.p__freesharevn.com.zip
Size

1.8MB
MD5

f89f2a67ff7a06564c7998a87a48b344
SHA1

7197b563239e3de9951b56632f1c144f7df0747c
SHA256

7796753a59f4a3d67e54f5430fb3bc638846f5d2f7b5c649b06201bcb3a3f46e
SHA512

21dfd2bb2814813ecae02381a3524d8be2576a35f79bc78c9c5e914e091ef7e54365843bfddc228430104e9a289b78280a6175896c9ddd384fba12d98fd7a709
SSDEEP

49152:39UC7h0b5EjPfJi/Z2k32XMhXI4RrdV5e5q/j8nm+TSd:tU8hgQ3DXMhXI4xT5eA/jZQI

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4132	svchost.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\StartAllBack3.6.15.4724_.p__freesharevn.com.zip
1⤵
PID:2232

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1192

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4132

memory/4132-0-0x0000023BA2C40000-0x0000023BA2C50000-memory.dmp

Filesize
64KB

Download
memory/4132-16-0x0000023BA2D40000-0x0000023BA2D50000-memory.dmp

Filesize
64KB

Download
memory/4132-32-0x0000023BAB0A0000-0x0000023BAB0A1000-memory.dmp

Filesize
4KB

Download
memory/4132-34-0x0000023BAB0D0000-0x0000023BAB0D1000-memory.dmp

Filesize
4KB

Download
memory/4132-35-0x0000023BAB0D0000-0x0000023BAB0D1000-memory.dmp

Filesize
4KB

Download
memory/4132-36-0x0000023BAB1E0000-0x0000023BAB1E1000-memory.dmp

Filesize
4KB

Download