36ed94fb9f8ef3f5cbf8494ff6400d0be353ae7c223ed209bd85d466d1ba1ff7

Analysis

max time kernel
171s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 18:47

Target

36ed94fb9f8ef3f5cbf8494ff6400d0be353ae7c223ed209bd85d466d1ba1ff7.exe
Size

8KB
MD5

dc0d40579447b035d980cf0b8cd7667c
SHA1

c907f983cb27d5caec6c941e0712afcc973487d0
SHA256

36ed94fb9f8ef3f5cbf8494ff6400d0be353ae7c223ed209bd85d466d1ba1ff7
SHA512

ed37522b52b617877b5e5f7023a0138baf396c0b33393d6155dbb6bfa4b3347b737e5493cbde634fa1937d0094a7b9b543929e6f32b35331a8c6dc838f38d51b
SSDEEP

96:5g48vbNEbfZlmg9fVFBHDqPkNR0bejUoKKeyDvYKx4YG4qyZQFq+zNt:5ghJufi6tXy20Kj2KeyDQKqYXqMQMY

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3992	36ed94fb9f8ef3f5cbf8494ff6400d0be353ae7c223ed209bd85d466d1ba1ff7.exe

C:\Users\Admin\AppData\Local\Temp\36ed94fb9f8ef3f5cbf8494ff6400d0be353ae7c223ed209bd85d466d1ba1ff7.exe
"C:\Users\Admin\AppData\Local\Temp\36ed94fb9f8ef3f5cbf8494ff6400d0be353ae7c223ed209bd85d466d1ba1ff7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3992

memory/3992-0-0x0000000075070000-0x0000000075820000-memory.dmp

Filesize
7.7MB

Download
memory/3992-1-0x0000000000560000-0x0000000000568000-memory.dmp

Filesize
32KB

Download
memory/3992-2-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/3992-3-0x0000000075070000-0x0000000075820000-memory.dmp

Filesize
7.7MB

Download
memory/3992-4-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download