a88a7ee7d56c9df10baa2ad43737dfcd2aae5e2a0cf5f08b826491b6f9eb84b3

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 01:30

Target

a88a7ee7d56c9df10baa2ad43737dfcd2aae5e2a0cf5f08b826491b6f9eb84b3.exe
Size

278KB
MD5

6e418f4e1d5323372f1c7f44825ada87
SHA1

9f134a8ee3cb1894aafe307521623efd0ee711b7
SHA256

a88a7ee7d56c9df10baa2ad43737dfcd2aae5e2a0cf5f08b826491b6f9eb84b3
SHA512

e391d0c11a83d978146a05e339b855deb8576dc979f0088b53d26f8b191904535cea0a97dc43c370784c7365f0e81bb51edfb0a8f287eef161ab69775f5dac3e
SSDEEP

6144:+EPEeMmHa3sh4uZNQp3CVA+//ZBuJcwtlFX3g5c:aeMQZCPpy0dt

Score

9^/10

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral1/memory/2656-1-0x0000000000C20000-0x0000000000C6A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2656	a88a7ee7d56c9df10baa2ad43737dfcd2aae5e2a0cf5f08b826491b6f9eb84b3.exe

C:\Users\Admin\AppData\Local\Temp\a88a7ee7d56c9df10baa2ad43737dfcd2aae5e2a0cf5f08b826491b6f9eb84b3.exe
"C:\Users\Admin\AppData\Local\Temp\a88a7ee7d56c9df10baa2ad43737dfcd2aae5e2a0cf5f08b826491b6f9eb84b3.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2656

memory/2656-0-0x000000007465E000-0x000000007465F000-memory.dmp

Filesize
4KB

Download
memory/2656-1-0x0000000000C20000-0x0000000000C6A000-memory.dmp

Filesize
296KB

Download
memory/2656-2-0x0000000074650000-0x0000000074D3E000-memory.dmp

Filesize
6.9MB

Download
memory/2656-3-0x000000007465E000-0x000000007465F000-memory.dmp

Filesize
4KB

Download
memory/2656-4-0x0000000074650000-0x0000000074D3E000-memory.dmp

Filesize
6.9MB

Download