70566aebcd8c141e593d00e189a43ee1d9b08e745aaf3043153c2087ba8c2671

Analysis

max time kernel
131s
max time network
142s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
24/12/2023, 02:05

Target

70566aebcd8c141e593d00e189a43ee1d9b08e745aaf3043153c2087ba8c2671.exe
Size

56KB
MD5

b0d3f508b4ff81f796f0a9ee1520911f
SHA1

45563437253a445b36c97d152eecae3d9de59b09
SHA256

70566aebcd8c141e593d00e189a43ee1d9b08e745aaf3043153c2087ba8c2671
SHA512

a52d64db272d21f0b485ef082431fea2754acb24eebde4079b17d53b3a64cc6afb671d35d218e5ece4ce24bdd901bcec3d81b16f01547d32932a9e1f0f688c33
SSDEEP

768:kdiv4Kbwg2V+YV5QfADYI1WQZConqLMh0AoE7pwaambG4lRFVPJ1M2RhXIxT:k+b5sCKqLzECafbX3zxTRpIxT

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1932	70566aebcd8c141e593d00e189a43ee1d9b08e745aaf3043153c2087ba8c2671.exe

C:\Users\Admin\AppData\Local\Temp\70566aebcd8c141e593d00e189a43ee1d9b08e745aaf3043153c2087ba8c2671.exe
"C:\Users\Admin\AppData\Local\Temp\70566aebcd8c141e593d00e189a43ee1d9b08e745aaf3043153c2087ba8c2671.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1932

memory/1932-0-0x0000000000A40000-0x0000000000A54000-memory.dmp

Filesize
80KB

Download
memory/1932-1-0x00007FF830160000-0x00007FF830B4C000-memory.dmp

Filesize
9.9MB

Download
memory/1932-2-0x000000001B820000-0x000000001B830000-memory.dmp

Filesize
64KB

Download
memory/1932-3-0x00007FF84CCE0000-0x00007FF84CEBB000-memory.dmp

Filesize
1.9MB

Download
memory/1932-4-0x00007FF830160000-0x00007FF830B4C000-memory.dmp

Filesize
9.9MB

Download
memory/1932-5-0x000000001B820000-0x000000001B830000-memory.dmp

Filesize
64KB

Download
memory/1932-6-0x00007FF84CCE0000-0x00007FF84CEBB000-memory.dmp

Filesize
1.9MB

Download