e16650148b8259df96f8ffaa842b3bdacadda28d9415a606996351525a93fb7c

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 05:08

Target

e16650148b8259df96f8ffaa842b3bdacadda28d9415a606996351525a93fb7c.exe
Size

1.2MB
MD5

b426c98a8814978c796959e7da8783ae
SHA1

c5b78c314794e3dc76448ce721947f8b0ccdb233
SHA256

e16650148b8259df96f8ffaa842b3bdacadda28d9415a606996351525a93fb7c
SHA512

2d0274a58192bcf03c00626bcbbee1f9dbff8dba789f5a7ea4697e97c54969ea8ab6d2080664cf5452f806bd14c71dd6787c1092ae629ca17ed7fb35d13889a7
SSDEEP

24576:Xlv3yIUPE1Bubmq3nT6j3mhG/5ESOhoaJlmUvgAPS9pjY:XlfyIUPE1BuB3ujWhG/1OfMUgAkp8

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2228	e16650148b8259df96f8ffaa842b3bdacadda28d9415a606996351525a93fb7c.exe

C:\Users\Admin\AppData\Local\Temp\e16650148b8259df96f8ffaa842b3bdacadda28d9415a606996351525a93fb7c.exe
"C:\Users\Admin\AppData\Local\Temp\e16650148b8259df96f8ffaa842b3bdacadda28d9415a606996351525a93fb7c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2228

memory/2228-0-0x0000000140000000-0x000000014013A000-memory.dmp

Filesize
1.2MB

Download
memory/2228-2-0x0000000001D40000-0x0000000001DA0000-memory.dmp

Filesize
384KB

Download
memory/2228-10-0x0000000001D40000-0x0000000001DA0000-memory.dmp

Filesize
384KB

Download
memory/2228-12-0x0000000140000000-0x000000014013A000-memory.dmp

Filesize
1.2MB

Download
memory/2228-7-0x0000000001D40000-0x0000000001DA0000-memory.dmp

Filesize
384KB

Download