1cc417c05d1a0ffc1f480e33158fb8230c093ab22b1bc90371e189ab8aaf96a1

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 16:46

Target

28050c06cb9377a1f54773370b24723e0d2849b5b71899bed40b9da7837f2974.exe
Size

43KB
MD5

d406ce5200488ab3fb725bbd16324864
SHA1

f7f619307ec9b463abfc7ede001274d12cdc447e
SHA256

28050c06cb9377a1f54773370b24723e0d2849b5b71899bed40b9da7837f2974
SHA512

461822da36db093cae46ab3b1a5fa34617f9fb37bec97c38c33efd134c61df75fecc3192442005645c30c411d6e0eedff6d130c053d80ad557064df12c89a883
SSDEEP

768:XIeRwUuo7jHzx2ET1RVfyCSUz2rx2ET1RVfyCSUzcA20I2BDWNAMxkEQp:1RTuCxH1RAO2rxH1RAOcAsCWFx6

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

28050c06cb9377a1f54773370b24723e0d2849b5b71899bed40b9da7837f2974.exe

description pid process

Token: SeDebugPrivilege 2980 28050c06cb9377a1f54773370b24723e0d2849b5b71899bed40b9da7837f2974.exe

description	pid	process
Token: SeDebugPrivilege	2980	28050c06cb9377a1f54773370b24723e0d2849b5b71899bed40b9da7837f2974.exe

C:\Users\Admin\AppData\Local\Temp\28050c06cb9377a1f54773370b24723e0d2849b5b71899bed40b9da7837f2974.exe
"C:\Users\Admin\AppData\Local\Temp\28050c06cb9377a1f54773370b24723e0d2849b5b71899bed40b9da7837f2974.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2980

memory/2980-0-0x0000000000860000-0x000000000086E000-memory.dmp

Filesize
56KB

Download
memory/2980-1-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download
memory/2980-2-0x0000000000730000-0x0000000000770000-memory.dmp

Filesize
256KB

Download
memory/2980-4-0x0000000000220000-0x000000000022A000-memory.dmp

Filesize
40KB

Download
memory/2980-3-0x0000000000220000-0x000000000022A000-memory.dmp

Filesize
40KB

Download
memory/2980-5-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download
memory/2980-6-0x0000000000730000-0x0000000000770000-memory.dmp

Filesize
256KB

Download