ca9290e039e90f5b8c5b028f2153aec63e715ece4f200fc4fb5e06da5c865aa2

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 12:06

Target

RW-TS-Payment204_A3084_04893_D4084_Y5902_CE3018_S4081_W30981.exe
Size

654KB
MD5

a9c58121c9cd1568a44acaba531823e0
SHA1

8d60d577bad58094d3674d4a34f8d5d68d5d3ab9
SHA256

ca9290e039e90f5b8c5b028f2153aec63e715ece4f200fc4fb5e06da5c865aa2
SHA512

94ee39a5adfae346d78c85b13757d6e60a9cf14c537c02d2bdb36461d704c2ac1eb9a90e1fcc1741792085dd7a0beaa125ca26b95c5c7c6cfbe4cac6704d5789
SSDEEP

12288:jITPVidCQdvxPR8dwceN6Ckn/q3m2Ta0O+P:jITuvxPR8acq6C0/Y/e0Og

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2244	RW-TS-Payment204_A3084_04893_D4084_Y5902_CE3018_S4081_W30981.exe

C:\Users\Admin\AppData\Local\Temp\RW-TS-Payment204_A3084_04893_D4084_Y5902_CE3018_S4081_W30981.exe
"C:\Users\Admin\AppData\Local\Temp\RW-TS-Payment204_A3084_04893_D4084_Y5902_CE3018_S4081_W30981.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2244

memory/2244-0-0x0000000073EBE000-0x0000000073EBF000-memory.dmp

Filesize
4KB

Download
memory/2244-1-0x0000000001300000-0x00000000013A6000-memory.dmp

Filesize
664KB

Download
memory/2244-2-0x0000000073EB0000-0x000000007459E000-memory.dmp

Filesize
6.9MB

Download
memory/2244-3-0x0000000073EBE000-0x0000000073EBF000-memory.dmp

Filesize
4KB

Download
memory/2244-4-0x0000000073EB0000-0x000000007459E000-memory.dmp

Filesize
6.9MB

Download