b782dbd696f87d28831fb8dab4efc6d3779e04ceb305c235acd59bf076116cd5

Analysis

max time kernel
286s
max time network
288s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 10:07

Target

nvmp_start.exe
Size

1.0MB
MD5

d0607f951dbbe8f0ed8925b53b9776b9
SHA1

2c34a27bf2fe530af103fd283a31261c2cc9522d
SHA256

51d37de464bb935334078b94e281ae212f3d136f3c490752270e6b188cf18032
SHA512

963b3e08c0f0ef6ee079efc1ea5aeec6f165d6882460919507977b04ccf62e2515c647d27e2434456ee588dd073485ecfcf84dcf3d18f56596b56dfaea5544f5
SSDEEP

24576:TEGA+qic7Epd18qGHlZ26aipYYX2XcpaxttIw/v2mWG2mWG2mWG2mWGVF1lVF1lm:YN1Kn1G7taAYYGXcmtV/v2mWG2mWG2mu

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1896	svchost.exe

C:\Users\Admin\AppData\Local\Temp\nvmp_start.exe
"C:\Users\Admin\AppData\Local\Temp\nvmp_start.exe"
1⤵
PID:2980

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1896

memory/1896-0-0x000001D579D90000-0x000001D579DA0000-memory.dmp

Filesize
64KB

Download
memory/1896-16-0x000001D579E90000-0x000001D579EA0000-memory.dmp

Filesize
64KB

Download
memory/1896-32-0x000001D57E200000-0x000001D57E201000-memory.dmp

Filesize
4KB

Download
memory/1896-34-0x000001D57E230000-0x000001D57E231000-memory.dmp

Filesize
4KB

Download
memory/1896-35-0x000001D57E230000-0x000001D57E231000-memory.dmp

Filesize
4KB

Download
memory/1896-36-0x000001D57E340000-0x000001D57E341000-memory.dmp

Filesize
4KB

Download