18e4a0337581bbf779ead9c00d59a59d3cf60d880d884d06c50e88d88674d013

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2023 11:30

Target

lior.exe
Size

904KB
MD5

eb9f68dab29169e2704074b03d880ff1
SHA1

98940e572b05a2da5e90623206f2f11812850bb3
SHA256

18e4a0337581bbf779ead9c00d59a59d3cf60d880d884d06c50e88d88674d013
SHA512

adc29ce02ac70339459a28f1fb6d38ca258e24f6dabfd72d07be3423b38514bdb3aa332858968dbd0daf0b2d4f9eed2c916422479fb3f9b70c743eb8a6023a46
SSDEEP

24576:Kdc8cY5G1FOPjWcjL8TxNYqEv0rODHZ/lpWUmJKfplz72e10I:K5cY56OaccTtsWIZ/GUm0fpB7

Score

1^/10

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	4688	lior.exe
Token: SeAssignPrimaryTokenPrivilege	4688	lior.exe
Token: SeIncreaseQuotaPrivilege	4688	lior.exe

C:\Users\Admin\AppData\Local\Temp\lior.exe
"C:\Users\Admin\AppData\Local\Temp\lior.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4688
- \??\c:\Windows\System32\cmd.exe
  "c:\Windows\System32\cmd.exe"
  2⤵
  PID:1552

memory/4688-0-0x0000021CB66E0000-0x0000021CB67C6000-memory.dmp

Filesize
920KB

Download
memory/4688-1-0x00007FFDE60E0000-0x00007FFDE6BA1000-memory.dmp

Filesize
10.8MB

Download
memory/4688-2-0x0000021CB6B80000-0x0000021CB6B90000-memory.dmp

Filesize
64KB

Download
memory/4688-3-0x0000021CD0BF0000-0x0000021CD0EA2000-memory.dmp

Filesize
2.7MB

Download
memory/4688-5-0x00007FFDE60E0000-0x00007FFDE6BA1000-memory.dmp

Filesize
10.8MB

Download