5b469ceeb9a3db7ed9a8265830000f89ff60ef69c60885cf326d31db37fec50e

Analysis

max time kernel
144s
max time network
42s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 20:24

Target

5b469ceeb9a3db7ed9a8265830000f89ff60ef69c60885cf326d31db37fec50e.exe
Size

1.2MB
MD5

9b14d8885dc390522822f6bd90ec0a0f
SHA1

89f159e3b085f2e4551c460a8589e8f614b41fc6
SHA256

5b469ceeb9a3db7ed9a8265830000f89ff60ef69c60885cf326d31db37fec50e
SHA512

b01d4902b8f46fc8a223f9f23ad681bbafedae6c5fbe018fa12bd2779b0640ccad50174cf41534dd014782aadcf9e41a189646c767e718685f0d3e4ab2365d21
SSDEEP

24576:7aO2cY5wi3YDa4iJLfuQBCYjAI2L/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7aO2cz2L4iNffB3jWLNiXicJFFRGNzj3

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1632	5b469ceeb9a3db7ed9a8265830000f89ff60ef69c60885cf326d31db37fec50e.exe

C:\Users\Admin\AppData\Local\Temp\5b469ceeb9a3db7ed9a8265830000f89ff60ef69c60885cf326d31db37fec50e.exe
"C:\Users\Admin\AppData\Local\Temp\5b469ceeb9a3db7ed9a8265830000f89ff60ef69c60885cf326d31db37fec50e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1632

memory/1632-0-0x0000000140000000-0x0000000140138000-memory.dmp

Filesize
1.2MB

Download
memory/1632-7-0x0000000002090000-0x00000000020F0000-memory.dmp

Filesize
384KB

Download
memory/1632-12-0x0000000140000000-0x0000000140138000-memory.dmp

Filesize
1.2MB

Download
memory/1632-10-0x0000000002090000-0x00000000020F0000-memory.dmp

Filesize
384KB

Download
memory/1632-1-0x0000000002090000-0x00000000020F0000-memory.dmp

Filesize
384KB

Download