723935c249c4fc8e42bc5a4ae942dcca2ccc61b5d824e45aa68a8383504febcb

max time kernel
1775s
max time network
1164s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 12:06

Sharing

Target

main - Copy (5).exe
Size

6.9MB
MD5

22c978ffaefef3389bf29068b9621661
SHA1

5671972c1d70826fb85dced4c83c700dd282ea21
SHA256

e6ee8e9b38e10a92a89e61b8655ca4fedcc381fd93cb36f43fe323132923dfcf
SHA512

8a280cb782f0afab171d2e7955b75362e98cefd449d382004ef2568c2c230cd633a754b1dd5f0dc5e17407819e4dceb5b0cbb2647e279a6ec674b8d9484be26a
SSDEEP

98304:7b5Ak7khMiyw0VREqfnle5EEPbxVhCQHSIMf:5LUMiywZqshDxaQHh

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	456	svchost.exe

C:\Users\Admin\AppData\Local\Temp\main - Copy (5).exe
"C:\Users\Admin\AppData\Local\Temp\main - Copy (5).exe"
1⤵
PID:4348

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:456

memory/456-32-0x000001C5E5760000-0x000001C5E5761000-memory.dmp

Filesize
4KB

Download
memory/456-36-0x000001C5E58C0000-0x000001C5E58C1000-memory.dmp

Filesize
4KB

Download
memory/456-35-0x000001C5E5790000-0x000001C5E5791000-memory.dmp

Filesize
4KB

Download
memory/456-34-0x000001C5E5790000-0x000001C5E5791000-memory.dmp

Filesize
4KB

Download
memory/456-16-0x000001C5DD440000-0x000001C5DD450000-memory.dmp

Filesize
64KB

Download
memory/456-0-0x000001C5DD340000-0x000001C5DD350000-memory.dmp

Filesize
64KB

Download