92dfae5c4117871e7dd153692389eda73da26eae3d12df3de551964cf1f60dc6

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 13:40

Target

a958448ebe8889e0608aad280570bf06.exe
Size

9KB
MD5

a958448ebe8889e0608aad280570bf06
SHA1

9b39152c47a62cc8974b4a63eb2a922a22f0ba5e
SHA256

92dfae5c4117871e7dd153692389eda73da26eae3d12df3de551964cf1f60dc6
SHA512

dbce45149a54e5e807c85da639f55b33d87d103ab27a164b99a1849feda5a5c18c199cde4346a7e83f439118e29ad44da3dd426586db4e0c34e2ed36c0d31b34
SSDEEP

192:cBksurzHNQKYeMZZ3M93VnjdwqzH3u/NS:fHlYeMoFnhwqze/N

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5004	a958448ebe8889e0608aad280570bf06.exe

C:\Users\Admin\AppData\Local\Temp\a958448ebe8889e0608aad280570bf06.exe
"C:\Users\Admin\AppData\Local\Temp\a958448ebe8889e0608aad280570bf06.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5004

memory/5004-0-0x0000000000E10000-0x0000000000E18000-memory.dmp

Filesize
32KB

Download
memory/5004-1-0x00007FFB6EFE0000-0x00007FFB6FAA1000-memory.dmp

Filesize
10.8MB

Download
memory/5004-2-0x00000000014D0000-0x00000000014E2000-memory.dmp

Filesize
72KB

Download
memory/5004-3-0x0000000002F20000-0x0000000002F5C000-memory.dmp

Filesize
240KB

Download
memory/5004-4-0x0000000002FA0000-0x0000000002FB0000-memory.dmp

Filesize
64KB

Download
memory/5004-5-0x00007FFB6EFE0000-0x00007FFB6FAA1000-memory.dmp

Filesize
10.8MB

Download
memory/5004-6-0x00007FFB6EFE0000-0x00007FFB6FAA1000-memory.dmp

Filesize
10.8MB

Download