659df58d0b14ce00cefc60849e5ed547415ca7c918d1abb4d72e0fefc55d0f86

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 12:35

Target

659df58d0b14ce00cefc60849e5ed547415ca7c918d1abb4d72e0fefc55d0f86.exe
Size

1.6MB
MD5

de886a968a6e3cafefc4a9b47a6947e5
SHA1

de7b4471ea5199ff93fcd3dc7a05907aa8f840f7
SHA256

659df58d0b14ce00cefc60849e5ed547415ca7c918d1abb4d72e0fefc55d0f86
SHA512

fd611a61343881982f34f5b290e04564725e130e198473dbab61d4f7ec33832354c55bc722c9dfecef7a041d6f027a1b5a85145e46cc8323f4ba8f22d653ee4a
SSDEEP

12288:qTP/aK2vB+GXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3b:qLCKABFsqjnhMgeiCl7G0nehbGZpbD

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2904	659df58d0b14ce00cefc60849e5ed547415ca7c918d1abb4d72e0fefc55d0f86.exe

C:\Users\Admin\AppData\Local\Temp\659df58d0b14ce00cefc60849e5ed547415ca7c918d1abb4d72e0fefc55d0f86.exe
"C:\Users\Admin\AppData\Local\Temp\659df58d0b14ce00cefc60849e5ed547415ca7c918d1abb4d72e0fefc55d0f86.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2904

memory/2904-0-0x0000000000400000-0x0000000000697000-memory.dmp

Filesize
2.6MB

Download
memory/2904-1-0x0000000000240000-0x00000000002A7000-memory.dmp

Filesize
412KB

Download
memory/2904-7-0x0000000000240000-0x00000000002A7000-memory.dmp

Filesize
412KB

Download
memory/2904-6-0x0000000000240000-0x00000000002A7000-memory.dmp

Filesize
412KB

Download
memory/2904-11-0x0000000000400000-0x0000000000697000-memory.dmp

Filesize
2.6MB

Download