Analysis
-
max time kernel
139s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2023 09:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f4a9c54fcfd61cbb3e3e46332f3af3a29b70d4ef2090eeb8e338924e2cf5a762.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
f4a9c54fcfd61cbb3e3e46332f3af3a29b70d4ef2090eeb8e338924e2cf5a762.exe
-
Size
2.8MB
-
MD5
c495370c41ea9e8089e63311b6b70d72
-
SHA1
f25dce5329ccdb7ed1bda9a2ed23e557b2af607e
-
SHA256
f4a9c54fcfd61cbb3e3e46332f3af3a29b70d4ef2090eeb8e338924e2cf5a762
-
SHA512
291e6cfccba60c28be31c546f4503e72b959cedc7328d5ea799ada331c9a4cad26215bccab1be18c7b3bfabd9a255389ad5ba6fa6c526efd0dc2e36cf922ff47
-
SSDEEP
49152:8ghZ+2dUDxTghSZBfXfYaQ88Ay1IZsWP3+b/sVBYP18R4V8cvd/DypDoF0BipdL0:cRvIOZ
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1464 f4a9c54fcfd61cbb3e3e46332f3af3a29b70d4ef2090eeb8e338924e2cf5a762.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1464 f4a9c54fcfd61cbb3e3e46332f3af3a29b70d4ef2090eeb8e338924e2cf5a762.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4a9c54fcfd61cbb3e3e46332f3af3a29b70d4ef2090eeb8e338924e2cf5a762.exe"C:\Users\Admin\AppData\Local\Temp\f4a9c54fcfd61cbb3e3e46332f3af3a29b70d4ef2090eeb8e338924e2cf5a762.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1464