7a6aff7d06df1c3dbabac76a605ea8b84233ab10b10c4f9af782cb3518bad169

Analysis

max time kernel
105s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2024, 08:18

Target
7a6aff7d06df1c3dbabac76a605ea8b84233ab10b10c4f9af782cb3518bad169.exe
Size 1.6MB
Sample241113-j7bdaaybma
SHA256 7a6aff7d06df1c3dbabac76a605ea8b84233ab10b10c4f9af782cb3518bad169
MD5 3afcaaadcd323e076756b24026a1a324
SHA1 bdfd90ce9e4a7c21effee5bbdc848f9ba8927e0e
SHA512 815aafa6877a166959fad11d57da25fb6d62fc26afaa3fc56fc79234fc4fbd84db06a7a44f8b09165613408cc613b99ae827626c48a189154d0f8a282ddab4d4
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOYFg8ZY8:GemTLkNdfE0pZys
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1940	7a6aff7d06df1c3dbabac76a605ea8b84233ab10b10c4f9af782cb3518bad169.exe
Token: SeLockMemoryPrivilege	1940	7a6aff7d06df1c3dbabac76a605ea8b84233ab10b10c4f9af782cb3518bad169.exe

C:\Users\Admin\AppData\Local\Temp\7a6aff7d06df1c3dbabac76a605ea8b84233ab10b10c4f9af782cb3518bad169.exe
"C:\Users\Admin\AppData\Local\Temp\7a6aff7d06df1c3dbabac76a605ea8b84233ab10b10c4f9af782cb3518bad169.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1940

memory/1940-0-0x000001C978610000-0x000001C978620000-memory.dmp

Download