ad7b73f6d6850509e6c5d3ce4b078035a25474999267fb10093c729fbd0a950a

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 14:37

Target

ad7b73f6d6850509e6c5d3ce4b078035a25474999267fb10093c729fbd0a950a.exe
Size

1.4MB
MD5

bcc29bd2d2cc14d1e352bc56673a205c
SHA1

389e9fdaaec47937c20798f4f833acc75c648596
SHA256

ad7b73f6d6850509e6c5d3ce4b078035a25474999267fb10093c729fbd0a950a
SHA512

4b77e5843571e1d6b223026d3ce712ddf098672767ae7a30bb4bbfddb543476285c6c6c20dafbc24157b05c68f43261b41f40478b508af04930a2a2282cd8d74
SSDEEP

12288:Y1/0Ves/0LCTlYySh30bK0KWAeswuvXXj9YySNmE81oFk92kVMYc6W0RGCIcZFMm:TeS02ZShEK6YfXjRSN5zkS6WgIcMEK

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1284	ad7b73f6d6850509e6c5d3ce4b078035a25474999267fb10093c729fbd0a950a.exe

C:\Users\Admin\AppData\Local\Temp\ad7b73f6d6850509e6c5d3ce4b078035a25474999267fb10093c729fbd0a950a.exe
"C:\Users\Admin\AppData\Local\Temp\ad7b73f6d6850509e6c5d3ce4b078035a25474999267fb10093c729fbd0a950a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1284

memory/1284-0-0x00000000745EE000-0x00000000745EF000-memory.dmp

Filesize
4KB

Download
memory/1284-1-0x0000000000E50000-0x0000000000FB4000-memory.dmp

Filesize
1.4MB

Download
memory/1284-3-0x00000000002C0000-0x00000000002E2000-memory.dmp

Filesize
136KB

Download
memory/1284-10-0x00000000745E0000-0x0000000074CCE000-memory.dmp

Filesize
6.9MB

Download
memory/1284-11-0x00000000745E0000-0x0000000074CCE000-memory.dmp

Filesize
6.9MB

Download
memory/1284-12-0x00000000745E0000-0x0000000074CCE000-memory.dmp

Filesize
6.9MB

Download
memory/1284-13-0x00000000745E0000-0x0000000074CCE000-memory.dmp

Filesize
6.9MB

Download