6e8f403019c297d4a48d44ecf76bb5a1a04d7dafc89299003fcf083a44cff2fc

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 23:03

Target

6e8f403019c297d4a48d44ecf76bb5a1a04d7dafc89299003fcf083a44cff2fc.exe
Size

1.4MB
MD5

5297989add365b2a51de724e622deb33
SHA1

78ed421bce47d85a93d3ace32cc18f5039c8f2b3
SHA256

6e8f403019c297d4a48d44ecf76bb5a1a04d7dafc89299003fcf083a44cff2fc
SHA512

d7a7a7ba4eaba7f86b1175087f4f87c8516cd9794ff064d5dc138779ce14cc0b7ee281ed71d8420a00476f2853edc720d1db178896a37331f152fdbe3a631a86
SSDEEP

24576:RLWuWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:RC7xlMPdlR8v4UC0Eg6ET7M/I

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	832	6e8f403019c297d4a48d44ecf76bb5a1a04d7dafc89299003fcf083a44cff2fc.exe

C:\Users\Admin\AppData\Local\Temp\6e8f403019c297d4a48d44ecf76bb5a1a04d7dafc89299003fcf083a44cff2fc.exe
"C:\Users\Admin\AppData\Local\Temp\6e8f403019c297d4a48d44ecf76bb5a1a04d7dafc89299003fcf083a44cff2fc.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:832

memory/832-1-0x0000000100000000-0x0000000100165000-memory.dmp

Filesize
1.4MB

Download
memory/832-0-0x0000000000390000-0x00000000003F0000-memory.dmp

Filesize
384KB

Download
memory/832-9-0x0000000000390000-0x00000000003F0000-memory.dmp

Filesize
384KB

Download
memory/832-13-0x0000000100000000-0x0000000100165000-memory.dmp

Filesize
1.4MB

Download
memory/832-12-0x0000000000390000-0x00000000003F0000-memory.dmp

Filesize
384KB

Download