36ed94fb9f8ef3f5cbf8494ff6400d0be353ae7c223ed209bd85d466d1ba1ff7

Analysis

max time kernel
145s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
19-03-2024 18:47

Target

36ed94fb9f8ef3f5cbf8494ff6400d0be353ae7c223ed209bd85d466d1ba1ff7.exe
Size

8KB
MD5

dc0d40579447b035d980cf0b8cd7667c
SHA1

c907f983cb27d5caec6c941e0712afcc973487d0
SHA256

36ed94fb9f8ef3f5cbf8494ff6400d0be353ae7c223ed209bd85d466d1ba1ff7
SHA512

ed37522b52b617877b5e5f7023a0138baf396c0b33393d6155dbb6bfa4b3347b737e5493cbde634fa1937d0094a7b9b543929e6f32b35331a8c6dc838f38d51b
SSDEEP

96:5g48vbNEbfZlmg9fVFBHDqPkNR0bejUoKKeyDvYKx4YG4qyZQFq+zNt:5ghJufi6tXy20Kj2KeyDQKqYXqMQMY

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1264	36ed94fb9f8ef3f5cbf8494ff6400d0be353ae7c223ed209bd85d466d1ba1ff7.exe

C:\Users\Admin\AppData\Local\Temp\36ed94fb9f8ef3f5cbf8494ff6400d0be353ae7c223ed209bd85d466d1ba1ff7.exe
"C:\Users\Admin\AppData\Local\Temp\36ed94fb9f8ef3f5cbf8494ff6400d0be353ae7c223ed209bd85d466d1ba1ff7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1264

memory/1264-0-0x0000000074CC0000-0x0000000075471000-memory.dmp

Filesize
7.7MB

Download
memory/1264-1-0x0000000000040000-0x0000000000048000-memory.dmp

Filesize
32KB

Download
memory/1264-2-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

Filesize
64KB

Download
memory/1264-3-0x0000000074CC0000-0x0000000075471000-memory.dmp

Filesize
7.7MB

Download
memory/1264-4-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

Filesize
64KB

Download