b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2023 09:20

Target

7z2201-x64.exe
Size

1.5MB
MD5

a6a0f7c173094f8dafef996157751ecf
SHA1

c0dcae7c4c80be25661d22400466b4ea074fc580
SHA256

b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4
SHA512

965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94
SSDEEP

24576:mGIyixBMj+/A2d+UKnvT+LwZWj7iDDVVYrz0rbzGTw3DoA/sk6smE:mGbj+/BpKnvyIxVV/XDoAfmE

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 3440 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	3440	svchost.exe

C:\Users\Admin\AppData\Local\Temp\7z2201-x64.exe
"C:\Users\Admin\AppData\Local\Temp\7z2201-x64.exe"
1⤵
PID:1972

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3616

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3440

memory/3440-0-0x00000237313A0000-0x00000237313B0000-memory.dmp

Filesize
64KB

Download
memory/3440-16-0x00000237314A0000-0x00000237314B0000-memory.dmp

Filesize
64KB

Download
memory/3440-32-0x0000023739810000-0x0000023739811000-memory.dmp

Filesize
4KB

Download
memory/3440-34-0x0000023739840000-0x0000023739841000-memory.dmp

Filesize
4KB

Download
memory/3440-35-0x0000023739840000-0x0000023739841000-memory.dmp

Filesize
4KB

Download
memory/3440-36-0x0000023739950000-0x0000023739951000-memory.dmp

Filesize
4KB

Download