e73b3c939cf1dc3054fb57ec128cb139d369a46f042f7e5129eab36f1bfba109

Analysis

max time kernel
1386s
max time network
1182s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 18:07

Target

$INTERNET_CACHE/Requests
Size

151KB
MD5

a6ae575cb7aef7791cf81a60a794c924
SHA1

56cf2a645948461887a4eef5aa00fc2d76b2a343
SHA256

aea55379939f0c1b0690031b64e8338f33c9abaf7ab29ed168338e26e0652d64
SHA512

bbb39599eac28be9ae285db1c8b47c25c73443b0f12e08e425f35fc01cacec65e5467440f437e2314ac8de8a6e4a6a368375f1948ebff8372deecfef5a441661
SSDEEP

3072:epVIa0/vidXqGjLPQ6ClAMfA4lelIJBSLPNG/:e/12vk6AQzyMfA+em

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 1508 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	1508	svchost.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Requests
1⤵
PID:3200

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:5576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1508

memory/1508-0-0x000001F7728B0000-0x000001F7728C0000-memory.dmp

Filesize
64KB

Download
memory/1508-16-0x000001F7729B0000-0x000001F7729C0000-memory.dmp

Filesize
64KB

Download
memory/1508-32-0x000001F77AD20000-0x000001F77AD21000-memory.dmp

Filesize
4KB

Download
memory/1508-34-0x000001F77AD50000-0x000001F77AD51000-memory.dmp

Filesize
4KB

Download
memory/1508-35-0x000001F77AD50000-0x000001F77AD51000-memory.dmp

Filesize
4KB

Download
memory/1508-36-0x000001F77AE60000-0x000001F77AE61000-memory.dmp

Filesize
4KB

Download