681ff6e2106231b3acd4c1238e9e6f15107e9f66436e6929cff7f01353e13031

Analysis

max time kernel
4s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
23-05-2024 18:30

Target

MinecraftTextureStudio.exe
Size

6.1MB
MD5

4ba4106746c0c6248ed3ebdc7f3e61db
SHA1

0c5828532bdfdc4bfcd9ebdeb181aa59035087e4
SHA256

7310be30f2c0fdda3eb6d94b5394725913bb44f84ffe6b9d8b3fb390b19f0598
SHA512

7a4b89d3780fe044442f1c145aa6ab71d63ecb2a78935701ccd62214168bf99771152146e9b7e9c6b1c98f76d5ba2ac9a51854dc5edde313018d2d7f4074ea76
SSDEEP

24576:offhbuBOsYVDABOsYVDABOsYVDABOsYVDABOsYVDABOsYVD0BOsYVD9DWBOsYVDP:8VuzzzzzNODW2

Score

1^/10

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

MinecraftTextureStudio.exe

description	pid	process
Token: SeDebugPrivilege	4692	MinecraftTextureStudio.exe
Token: 33	4692	MinecraftTextureStudio.exe
Token: SeIncBasePriorityPrivilege	4692	MinecraftTextureStudio.exe

C:\Users\Admin\AppData\Local\Temp\MinecraftTextureStudio.exe
"C:\Users\Admin\AppData\Local\Temp\MinecraftTextureStudio.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4692

memory/4692-0-0x00007FFC1B913000-0x00007FFC1B915000-memory.dmp

Filesize
8KB

Download
memory/4692-1-0x000001A929F50000-0x000001A92A566000-memory.dmp

Filesize
6.1MB

Download
memory/4692-2-0x000001A92A9F0000-0x000001A92AA0C000-memory.dmp

Filesize
112KB

Download
memory/4692-4-0x00007FFC1B910000-0x00007FFC1C3D2000-memory.dmp

Filesize
10.8MB

Download
memory/4692-3-0x000001A945BA0000-0x000001A945CC2000-memory.dmp

Filesize
1.1MB

Download
memory/4692-5-0x00007FFC1B910000-0x00007FFC1C3D2000-memory.dmp

Filesize
10.8MB

Download
memory/4692-6-0x00007FFC1B910000-0x00007FFC1C3D2000-memory.dmp

Filesize
10.8MB

Download
memory/4692-7-0x00007FFC1B910000-0x00007FFC1C3D2000-memory.dmp

Filesize
10.8MB

Download