6dfdbf9797245f636c0df59f25968955f366a3cdd5b710d45de0ddd924360f87

Analysis

max time kernel
147s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 20:47

Target

6dfdbf9797245f636c0df59f25968955f366a3cdd5b710d45de0ddd924360f87.exe
Size

1.8MB
MD5

6a86e95bec51ff3bb628aa3de2a1855e
SHA1

431fb0cecde7030d4f11b2bcb8ab4a65ee7a9fcd
SHA256

6dfdbf9797245f636c0df59f25968955f366a3cdd5b710d45de0ddd924360f87
SHA512

6cddca30432de57c0e1c8f1aeb454853b9046c8ae3654004cdd575927b06badd91b6ebbc3359cb48316e3416e745f7aa9b0b3954619a3ec6c2209f7ee2e265cb
SSDEEP

24576:WGMEVL7m1Mao3TLx+K0wV/VjcUIrYcsYkEGRsyR4SIPH3m+hlT0TKvXrauuK7jca:Wom1s3TWwVJcUIx13XlTXvRuKIJysKw

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3996	6dfdbf9797245f636c0df59f25968955f366a3cdd5b710d45de0ddd924360f87.exe

C:\Users\Admin\AppData\Local\Temp\6dfdbf9797245f636c0df59f25968955f366a3cdd5b710d45de0ddd924360f87.exe
"C:\Users\Admin\AppData\Local\Temp\6dfdbf9797245f636c0df59f25968955f366a3cdd5b710d45de0ddd924360f87.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3996

memory/3996-0-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/3996-1-0x0000000000950000-0x00000000009B6000-memory.dmp

Filesize
408KB

Download
memory/3996-6-0x0000000000950000-0x00000000009B6000-memory.dmp

Filesize
408KB

Download
memory/3996-7-0x0000000000950000-0x00000000009B6000-memory.dmp

Filesize
408KB

Download
memory/3996-12-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download