9fedf1aaea38b9847b0badbd1a47756ad0c48b541460530e1602485ef707ae0c

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-11-2024 02:45

Target

9fedf1aaea38b9847b0badbd1a47756ad0c48b541460530e1602485ef707ae0c.exe
Size

1.2MB
MD5

8b0616913d8e951d44f1df7403b14ba4
SHA1

99dcca8abee4a346e86cb3091af315e951d0da36
SHA256

9fedf1aaea38b9847b0badbd1a47756ad0c48b541460530e1602485ef707ae0c
SHA512

038675388446c9068beef387b0630f6e57d6ef9df5d2f145c78fabc41743608d574639d75f38faf010cf82b9a3e25e490a93e0b641ad537ae9f2b89225ea65a4
SSDEEP

6144:qQEnLie8O3JkyEPtCS/0imMPIAcaei7z4XYm/phOfJI5+GRSTneGRpr0wQGCztNv:qNie8EOyEP3/dAADrziYmxR5bdwDkNv

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2124	9fedf1aaea38b9847b0badbd1a47756ad0c48b541460530e1602485ef707ae0c.exe

C:\Users\Admin\AppData\Local\Temp\9fedf1aaea38b9847b0badbd1a47756ad0c48b541460530e1602485ef707ae0c.exe
"C:\Users\Admin\AppData\Local\Temp\9fedf1aaea38b9847b0badbd1a47756ad0c48b541460530e1602485ef707ae0c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2124

memory/2124-0-0x000007FEF5423000-0x000007FEF5424000-memory.dmp

Filesize
4KB

Download
memory/2124-1-0x00000000011A0000-0x00000000011A8000-memory.dmp

Filesize
32KB

Download
memory/2124-2-0x00000000002D0000-0x000000000034A000-memory.dmp

Filesize
488KB

Download
memory/2124-3-0x000007FEF5420000-0x000007FEF5E0C000-memory.dmp

Filesize
9.9MB

Download