b5ce197bb5107e62ef21561317cf31b700461e4d18222e4fb585446870f37a51

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 13:29

Target

a3eafacd45c0891ded9428d0f015aa94.exe
Size

9KB
MD5

a3eafacd45c0891ded9428d0f015aa94
SHA1

d989031db1baadd25ea62f857d61ddcc339756bc
SHA256

b5ce197bb5107e62ef21561317cf31b700461e4d18222e4fb585446870f37a51
SHA512

6cde4db605d261e6b056b2ebe4104eae3d49db0b1d8be5112e09d84c4b3d09a3b48e2161415fbaea7ffe0a3eab8a544d6448b73e8fc3a462f455d039e5c05c16
SSDEEP

192:UBksuDzHNQ8HYeMZZ3E93VnjdwqzN3mCG/es:fHpYeMIFnhwqh2Cee

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1760	a3eafacd45c0891ded9428d0f015aa94.exe

C:\Users\Admin\AppData\Local\Temp\a3eafacd45c0891ded9428d0f015aa94.exe
"C:\Users\Admin\AppData\Local\Temp\a3eafacd45c0891ded9428d0f015aa94.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1760

memory/1760-0-0x00000000006E0000-0x00000000006E8000-memory.dmp

Filesize
32KB

Download
memory/1760-1-0x0000000000EA0000-0x0000000000EB2000-memory.dmp

Filesize
72KB

Download
memory/1760-2-0x0000000001020000-0x000000000105C000-memory.dmp

Filesize
240KB

Download
memory/1760-3-0x00007FFF1B920000-0x00007FFF1C3E1000-memory.dmp

Filesize
10.8MB

Download
memory/1760-4-0x0000000000FE0000-0x0000000000FF0000-memory.dmp

Filesize
64KB

Download
memory/1760-5-0x00007FFF1B920000-0x00007FFF1C3E1000-memory.dmp

Filesize
10.8MB

Download
memory/1760-6-0x00007FFF1B920000-0x00007FFF1C3E1000-memory.dmp

Filesize
10.8MB

Download