209c5689179f329921d5a8ca8f645d6f34d947ed8525cab6a986bc2f1d8adc76

Analysis

max time kernel
132s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 22:46

Target
2024-05-24_647d6197246392733cb5e38081daf8a2_snatch.exe
Size 5.0MB
Sample240524-2qe91seb34
SHA256 209c5689179f329921d5a8ca8f645d6f34d947ed8525cab6a986bc2f1d8adc76
MD5 647d6197246392733cb5e38081daf8a2
SHA1 b9f935b6534e446b4868126a5bb65a855174cccc
SHA512 d9e6ee541224a1077e27541dd2b76e8358473d90afca1521cfdedb364652fdc3c9254c07fb82f6603bebf23715352214d6fd7d4f7b0210ff2fa14662af3c8a1d
SSDEEP 49152:Mxw14WfaSrrb/TDvO90d7HjmAFd4A64nsfJiIco9ae4mkJpGVEtdG5uCaqZjbF5l:5kW7jdG5uCaq9EU5ukKo
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	2024-05-24_647d6197246392733cb5e38081daf8a2_snatch.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-24_647d6197246392733cb5e38081daf8a2_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-24_647d6197246392733cb5e38081daf8a2_snatch.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3940,i,15142778360084620907,1763097090506261076,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
1⤵
PID:4480