28050c06cb9377a1f54773370b24723e0d2849b5b71899bed40b9da7837f2974

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10-03-2024 16:29

Target

SecuriteInfo.com.Program.Unwanted.5510.17823.1529.exe
Size

43KB
MD5

d406ce5200488ab3fb725bbd16324864
SHA1

f7f619307ec9b463abfc7ede001274d12cdc447e
SHA256

28050c06cb9377a1f54773370b24723e0d2849b5b71899bed40b9da7837f2974
SHA512

461822da36db093cae46ab3b1a5fa34617f9fb37bec97c38c33efd134c61df75fecc3192442005645c30c411d6e0eedff6d130c053d80ad557064df12c89a883
SSDEEP

768:XIeRwUuo7jHzx2ET1RVfyCSUz2rx2ET1RVfyCSUzcA20I2BDWNAMxkEQp:1RTuCxH1RAO2rxH1RAOcAsCWFx6

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SecuriteInfo.com.Program.Unwanted.5510.17823.1529.exe

description pid process

Token: SeDebugPrivilege 2332 SecuriteInfo.com.Program.Unwanted.5510.17823.1529.exe

description	pid	process
Token: SeDebugPrivilege	2332	SecuriteInfo.com.Program.Unwanted.5510.17823.1529.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.5510.17823.1529.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.5510.17823.1529.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2332

memory/2332-0-0x00000000010A0000-0x00000000010AE000-memory.dmp

Filesize
56KB

Download
memory/2332-1-0x0000000074740000-0x0000000074E2E000-memory.dmp

Filesize
6.9MB

Download
memory/2332-2-0x0000000004E00000-0x0000000004E40000-memory.dmp

Filesize
256KB

Download
memory/2332-3-0x00000000003A0000-0x00000000003AA000-memory.dmp

Filesize
40KB

Download
memory/2332-4-0x00000000003A0000-0x00000000003AA000-memory.dmp

Filesize
40KB

Download
memory/2332-5-0x0000000074740000-0x0000000074E2E000-memory.dmp

Filesize
6.9MB

Download
memory/2332-6-0x0000000004E00000-0x0000000004E40000-memory.dmp

Filesize
256KB

Download