3cfb7143ffaf8f881aab0707f1a296392ea759e499d6aa943172542a4b38b7d1

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 07:42

Target

486879061d100f42274fef5f3677416c.exe
Size

221KB
MD5

486879061d100f42274fef5f3677416c
SHA1

d4f6084ab6897135be938b6d59654b1c71b29c7c
SHA256

3cfb7143ffaf8f881aab0707f1a296392ea759e499d6aa943172542a4b38b7d1
SHA512

d18f31b150b5210151a0275aea1310be040885ce78e5db7b63d37091fc969ed39f23913ddfb1ec403433387b52098ac97904fedde2e07913c4febe5cf7af41db
SSDEEP

6144:AnU+HZYO5K6lIVlyq/oi2p9DOdhsHmYLs4wTWjtvn7q53sKmAIa:L+5YO5xi2p93GYLs4wGtjwsKL

Score

1^/10

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1964	486879061d100f42274fef5f3677416c.exe
Token: SeSecurityPrivilege	1964	486879061d100f42274fef5f3677416c.exe
Token: SeTakeOwnershipPrivilege	1964	486879061d100f42274fef5f3677416c.exe
Token: SeLoadDriverPrivilege	1964	486879061d100f42274fef5f3677416c.exe
Token: SeSystemProfilePrivilege	1964	486879061d100f42274fef5f3677416c.exe
Token: SeSystemtimePrivilege	1964	486879061d100f42274fef5f3677416c.exe
Token: SeProfSingleProcessPrivilege	1964	486879061d100f42274fef5f3677416c.exe
Token: SeIncBasePriorityPrivilege	1964	486879061d100f42274fef5f3677416c.exe
Token: SeCreatePagefilePrivilege	1964	486879061d100f42274fef5f3677416c.exe
Token: SeShutdownPrivilege	1964	486879061d100f42274fef5f3677416c.exe
Token: SeDebugPrivilege	1964	486879061d100f42274fef5f3677416c.exe
Token: SeSystemEnvironmentPrivilege	1964	486879061d100f42274fef5f3677416c.exe
Token: SeRemoteShutdownPrivilege	1964	486879061d100f42274fef5f3677416c.exe
Token: SeUndockPrivilege	1964	486879061d100f42274fef5f3677416c.exe
Token: SeManageVolumePrivilege	1964	486879061d100f42274fef5f3677416c.exe
Token: 33	1964	486879061d100f42274fef5f3677416c.exe
Token: 34	1964	486879061d100f42274fef5f3677416c.exe
Token: 35	1964	486879061d100f42274fef5f3677416c.exe

C:\Users\Admin\AppData\Local\Temp\486879061d100f42274fef5f3677416c.exe
"C:\Users\Admin\AppData\Local\Temp\486879061d100f42274fef5f3677416c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1964

memory/1964-2-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1964-1-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/1964-0-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1964-3-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1964-5-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download