77cb792e3da518b1c70b0efd0485bf48b35c12c7ac608e34c665a626bf8ebc33

Analysis

max time kernel
148s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:17

Target

NewKp.exe
Size

574KB
MD5

c5ba0bb78c17207535f9202dd6158afd
SHA1

f81691dc2bf3fc2cb39797bb5275ad96386f5500
SHA256

03c2907a1212c55bb05119bf381f3649aaba23874f5c106e677cffa36b4b664d
SHA512

6c39178642bd9ae81d4b727e31f248763567af7f3a7b35ec66154980356b757c41faf9b16828e9e43ae84f438d0c5f3c16e0b64f8d7fbfe7515ac0c1b5c45c1f
SSDEEP

12288:mEIfs7yFh1ugpQ5AyHofF8f1b/KQJV4jdg:vwpLt8f1XT4jdg

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

NewKp.exe

description pid process

Token: SeDebugPrivilege 3452 NewKp.exe

description	pid	process
Token: SeDebugPrivilege	3452	NewKp.exe

C:\Users\Admin\AppData\Local\Temp\NewKp.exe
"C:\Users\Admin\AppData\Local\Temp\NewKp.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3452

memory/3452-0-0x0000000074D6E000-0x0000000074D6F000-memory.dmp

Filesize
4KB

Download
memory/3452-1-0x0000000000410000-0x00000000004A6000-memory.dmp

Filesize
600KB

Download
memory/3452-2-0x0000000005350000-0x00000000058F4000-memory.dmp

Filesize
5.6MB

Download
memory/3452-3-0x0000000004EA0000-0x0000000004F32000-memory.dmp

Filesize
584KB

Download
memory/3452-5-0x0000000074D60000-0x0000000075510000-memory.dmp

Filesize
7.7MB

Download
memory/3452-4-0x0000000005050000-0x000000000505A000-memory.dmp

Filesize
40KB

Download
memory/3452-6-0x0000000006570000-0x00000000068C4000-memory.dmp

Filesize
3.3MB

Download
memory/3452-8-0x0000000074D6E000-0x0000000074D6F000-memory.dmp

Filesize
4KB

Download
memory/3452-9-0x0000000074D60000-0x0000000075510000-memory.dmp

Filesize
7.7MB

Download