e73b3c939cf1dc3054fb57ec128cb139d369a46f042f7e5129eab36f1bfba109

Analysis

max time kernel
1736s
max time network
1093s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 18:07

Target

$INTERNET_CACHE/Kent
Size

248KB
MD5

09a75a7672dacb0212987b5934cc7f69
SHA1

6e2ac25ede8438ca3b2bea01707b87c430099088
SHA256

ac2c44b3e720bbc3df04dd0e2e32497bc7a508f571bf1b54fce19489c982181e
SHA512

090bf2a18e6504d061ca9f3dcfad7e4781fdbbd4840d830d6edd93a05d0cf148be8c9aad21b473f7b301b166898bde2550fc635c0862f7b8d24beb14c9e6342b
SSDEEP

6144:5qKKah8OW0/5zpaOcjzUo39d0l5MBeai5X:I47Ws51a1/Uo3kl6iV

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 3624 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	3624	svchost.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Kent
1⤵
PID:4008

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3624

memory/3624-0-0x0000021432740000-0x0000021432750000-memory.dmp

Filesize
64KB

Download
memory/3624-16-0x0000021432840000-0x0000021432850000-memory.dmp

Filesize
64KB

Download
memory/3624-32-0x000002143AB60000-0x000002143AB61000-memory.dmp

Filesize
4KB

Download
memory/3624-34-0x000002143AB90000-0x000002143AB91000-memory.dmp

Filesize
4KB

Download
memory/3624-35-0x000002143AB90000-0x000002143AB91000-memory.dmp

Filesize
4KB

Download
memory/3624-36-0x000002143ACA0000-0x000002143ACA1000-memory.dmp

Filesize
4KB

Download