689323f73ff87d90d1fbc500ed13bf412df355bb7ca2916ea4a2fa7389560a06

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
11/11/2023, 05:45

Target

689323f73ff87d90d1fbc500ed13bf412df355bb7ca2916ea4a2fa7389560a06.exe
Size

1.3MB
MD5

e4d820089f09871731edd09394292273
SHA1

f452b36eb96c47bdb543157eb584c31d4836aef8
SHA256

689323f73ff87d90d1fbc500ed13bf412df355bb7ca2916ea4a2fa7389560a06
SHA512

7be41c364a1507eeb8fbf4bc88fdcd03b59aa1517cd7f8b8617a5ea6f5d2e97f2b499afa741f4db31e6d6387542c2bbcda8da07f08dae2eea4253ad5fbf8397d
SSDEEP

12288:r69B+VvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:r69B+sqjnhMgeiCl7G0nehbGZpbD

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2096	689323f73ff87d90d1fbc500ed13bf412df355bb7ca2916ea4a2fa7389560a06.exe

C:\Users\Admin\AppData\Local\Temp\689323f73ff87d90d1fbc500ed13bf412df355bb7ca2916ea4a2fa7389560a06.exe
"C:\Users\Admin\AppData\Local\Temp\689323f73ff87d90d1fbc500ed13bf412df355bb7ca2916ea4a2fa7389560a06.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2096

memory/2096-0-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/2096-1-0x0000000000240000-0x00000000002A7000-memory.dmp

Filesize
412KB

Download
memory/2096-6-0x0000000000240000-0x00000000002A7000-memory.dmp

Filesize
412KB

Download
memory/2096-7-0x0000000000240000-0x00000000002A7000-memory.dmp

Filesize
412KB

Download
memory/2096-11-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download