6c2e59b3ecc0e453a141e7229e25cafeb286ebe27c0c68096c18bfb3ce97b50a

Resubmissions

21-05-2024 14:05

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 14:05

Target

IntegrationWizard32.exe
Size

614KB
MD5

8d188050b9e4c0a5f0f24fcea65b1133
SHA1

3b1d04ee1adec2cd53d8721aee45fc112b5700da
SHA256

6c2e59b3ecc0e453a141e7229e25cafeb286ebe27c0c68096c18bfb3ce97b50a
SHA512

e220c535bd4bcc6897eb892e5731ad6e78ffb6d642dffb2ae104e8b5d642cdb53bd2a8e3e90ca62c7b199f85559467f2af0ebee62c1e75b3ca5e2e90c1b53ba8
SSDEEP

12288:8iB7dH1DCGUOdUQ0W+c2B7iQnPnaUwwi99Jygpji//y1z79clq1HIJA+lv:845NUdvaUwwD6i//Y39tZIJAS

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

IntegrationWizard32.exe

description pid process

Token: SeRestorePrivilege 2188 IntegrationWizard32.exe
Token: SeTakeOwnershipPrivilege 2188 IntegrationWizard32.exe

description	pid	process
Token: SeRestorePrivilege	2188	IntegrationWizard32.exe
Token: SeTakeOwnershipPrivilege	2188	IntegrationWizard32.exe

C:\Users\Admin\AppData\Local\Temp\IntegrationWizard32.exe
"C:\Users\Admin\AppData\Local\Temp\IntegrationWizard32.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2188