7683940f0a036e3a162f6f5485ca0c84e71058211920f9acb2094b8cfbb29db4

Analysis

max time kernel
120s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-12-2023 09:36

Target

7683940f0a036e3a162f6f5485ca0c84e71058211920f9acb2094b8cfbb29db4.exe
Size

1.3MB
MD5

35fb72fd05ce26c8ab37bf23d32dd20d
SHA1

af9bb76cf671f3fb6cc3d3d5f769439469295298
SHA256

7683940f0a036e3a162f6f5485ca0c84e71058211920f9acb2094b8cfbb29db4
SHA512

1aeefc02f20813ebd959ae4e416063491deebb34e092753ca3bdcc1a88db1970f83b6af65a0dfd8caa4be3565837187e1bc26192312b4a3f1284562419ba8128
SSDEEP

12288:r99B+Vn2rQ9KbFwOKpOz5N9vWst3QVkBNhw6Y5o+SudAfh39z2Go:r99BQEQkbvK8N3t3QVkLhoo+SVfhl2/

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2704	7683940f0a036e3a162f6f5485ca0c84e71058211920f9acb2094b8cfbb29db4.exe

C:\Users\Admin\AppData\Local\Temp\7683940f0a036e3a162f6f5485ca0c84e71058211920f9acb2094b8cfbb29db4.exe
"C:\Users\Admin\AppData\Local\Temp\7683940f0a036e3a162f6f5485ca0c84e71058211920f9acb2094b8cfbb29db4.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2704

memory/2704-0-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/2704-1-0x0000000000240000-0x00000000002A6000-memory.dmp

Filesize
408KB

Download
memory/2704-7-0x0000000000240000-0x00000000002A6000-memory.dmp

Filesize
408KB

Download
memory/2704-11-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download