f9dec31b96408fae90287d935e4e5c4789c9890a610d3f1c6530cc7baeec5af6

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2023 12:07

Target

f9dec31b96408fae90287d935e4e5c4789c9890a610d3f1c6530cc7baeec5af6.exe
Size

3.7MB
MD5

cf05b4b5efd4264831fb4a5b001afe9a
SHA1

92b695b935a091128608dbae9f43ee69eff7e4bc
SHA256

f9dec31b96408fae90287d935e4e5c4789c9890a610d3f1c6530cc7baeec5af6
SHA512

6aa79fe884c69c14907c890ecda67d78c26aafc3c2699e8dc3cd2d79af8f3d0f419daadb53ec1d721da284f0263ce43748cd0a3ad4c63173df0c120b230958c2
SSDEEP

24576:U6sW65Ghu0Ap2sG/DILED55eaYdGOehFojPRakn8ALSp:UoXDIYYaYQOzTLS

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4232	svchost.exe

C:\Users\Admin\AppData\Local\Temp\f9dec31b96408fae90287d935e4e5c4789c9890a610d3f1c6530cc7baeec5af6.exe
"C:\Users\Admin\AppData\Local\Temp\f9dec31b96408fae90287d935e4e5c4789c9890a610d3f1c6530cc7baeec5af6.exe"
1⤵
PID:3288

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4232

memory/3288-0-0x0000000000400000-0x0000000001CBD000-memory.dmp

Filesize
24.7MB

Download
memory/4232-1-0x000001B0FE840000-0x000001B0FE850000-memory.dmp

Filesize
64KB

Download
memory/4232-17-0x000001B0FE940000-0x000001B0FE950000-memory.dmp

Filesize
64KB

Download
memory/4232-33-0x000001B0FEC80000-0x000001B0FEC81000-memory.dmp

Filesize
4KB

Download
memory/4232-35-0x000001B0FECB0000-0x000001B0FECB1000-memory.dmp

Filesize
4KB

Download
memory/4232-36-0x000001B0FECB0000-0x000001B0FECB1000-memory.dmp

Filesize
4KB

Download
memory/4232-37-0x000001B0FEDC0000-0x000001B0FEDC1000-memory.dmp

Filesize
4KB

Download