c9c660914e4d58a6e0dd460afae6e4af288c9f191ad8592dc95db5a69868fc70

max time kernel
90s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
11-05-2024 13:06

Sharing

Target

Loader.exe
Size

347KB
MD5

1cb742cb95699d994e1cc6810c6f7642
SHA1

103ea603322859742a3e51c5e517a927b9dcd40c
SHA256

c9c660914e4d58a6e0dd460afae6e4af288c9f191ad8592dc95db5a69868fc70
SHA512

79f9a70232b3470ef9386d9b3d987b5370d0562959315d8239509000a1aa9274b13cecc4c6c871cd4d258a0cd19d30574e3280edd54fb108b6ffca7d8c7e4795
SSDEEP

6144:RrwFDD0tZzmf7GxMLEYaEzE2d9JK5/J1pZKM35QM6KkfiruhbOuzB:Rg07e7seE2dK71rKu5Q6kfirIbOuF

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Loader.exe

description pid process

Token: SeDebugPrivilege 2656 Loader.exe

description	pid	process
Token: SeDebugPrivilege	2656	Loader.exe

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2656

memory/2656-0-0x0000000000EA0000-0x0000000000EFE000-memory.dmp

Filesize
376KB

Download
memory/2656-1-0x00007FFF8D633000-0x00007FFF8D635000-memory.dmp

Filesize
8KB

Download
memory/2656-2-0x00007FFF8D630000-0x00007FFF8E0F2000-memory.dmp

Filesize
10.8MB

Download
memory/2656-3-0x00007FFF8D630000-0x00007FFF8E0F2000-memory.dmp

Filesize
10.8MB

Download
memory/2656-5-0x00007FFF8D630000-0x00007FFF8E0F2000-memory.dmp

Filesize
10.8MB

Download