68d48d53b40a2c1c905dcfbb4062066dfdf38f24440da5ac3a679e466a96bf1e

Analysis

max time kernel
130s
max time network
139s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:44

Target

68d48d53b40a2c1c905dcfbb4062066dfdf38f24440da5ac3a679e466a96bf1e.exe
Size

461KB
MD5

3c5eeab605bf86d93dcd01aa912efa54
SHA1

c24a07068c65fbfa25ee47246703dd4b0bb5e8d2
SHA256

68d48d53b40a2c1c905dcfbb4062066dfdf38f24440da5ac3a679e466a96bf1e
SHA512

8ac3e8098970cbdcb55acba7e5b32d5c7422b5f67376d0f1f5956a6ef052e3c29dfea2f4f154c8856d97b2b3fc132771444d7c3bfc1fb2a8331fbaa835747f30
SSDEEP

6144:wSvm6/3XnxCPjtLXzgTYLvRkV4foyR2MDk7Tr/pjhpH3565Xnnz/UYx3c7XV:VYXFD+4fzR2zg4

Score

9^/10

Detects executables packed with SmartAssembly 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2288-1-0x0000000001140000-0x00000000011B6000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

68d48d53b40a2c1c905dcfbb4062066dfdf38f24440da5ac3a679e466a96bf1e.exe

description pid process

Token: SeDebugPrivilege 2288 68d48d53b40a2c1c905dcfbb4062066dfdf38f24440da5ac3a679e466a96bf1e.exe

description	pid	process
Token: SeDebugPrivilege	2288	68d48d53b40a2c1c905dcfbb4062066dfdf38f24440da5ac3a679e466a96bf1e.exe

C:\Users\Admin\AppData\Local\Temp\68d48d53b40a2c1c905dcfbb4062066dfdf38f24440da5ac3a679e466a96bf1e.exe
"C:\Users\Admin\AppData\Local\Temp\68d48d53b40a2c1c905dcfbb4062066dfdf38f24440da5ac3a679e466a96bf1e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2288

memory/2288-0-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

Filesize
4KB

Download
memory/2288-1-0x0000000001140000-0x00000000011B6000-memory.dmp

Filesize
472KB

Download
memory/2288-2-0x0000000074D40000-0x000000007542E000-memory.dmp

Filesize
6.9MB

Download
memory/2288-3-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

Filesize
4KB

Download
memory/2288-4-0x0000000074D40000-0x000000007542E000-memory.dmp

Filesize
6.9MB

Download