4a9c991527994dd637fbd97b26ad4db0f09895f2e7280a27dad0cceb03a828da

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
15/11/2023, 11:21

Target

qstopmotion.exe
Size

642KB
MD5

4beeba7dc0f5bf0dbbb6987ea979468c
SHA1

ef0abd16c87e6be094aa47fe38179e7f4e63bfb8
SHA256

4a9c991527994dd637fbd97b26ad4db0f09895f2e7280a27dad0cceb03a828da
SHA512

62395590ba0c11b3835e74ff916c095ba7a1e3b1af07f16a12442f2f6902dff08815a27985456668c81addd77edcd6500d8fa9990a0aa3ba2e39caf9a89be281
SSDEEP

12288:FVMsA56taT9lXVc8s5Aymtnz3JockJLLSDhKCI:FGTHlGmtz5ocaLLSDhA

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3864	svchost.exe

C:\Users\Admin\AppData\Local\Temp\qstopmotion.exe
"C:\Users\Admin\AppData\Local\Temp\qstopmotion.exe"
1⤵
PID:4180

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3864

memory/3864-0-0x0000025758B40000-0x0000025758B50000-memory.dmp

Filesize
64KB

Download
memory/3864-16-0x0000025758C40000-0x0000025758C50000-memory.dmp

Filesize
64KB

Download
memory/3864-32-0x0000025760F90000-0x0000025760F91000-memory.dmp

Filesize
4KB

Download
memory/3864-34-0x0000025760FC0000-0x0000025760FC1000-memory.dmp

Filesize
4KB

Download
memory/3864-35-0x0000025760FC0000-0x0000025760FC1000-memory.dmp

Filesize
4KB

Download
memory/3864-36-0x00000257610D0000-0x00000257610D1000-memory.dmp

Filesize
4KB

Download