68b0e7620b0e7fa81bb6fc791dc61ad0e142c55ede9c69a3993945538796778c

Analysis

max time kernel
105s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2024, 17:27

Target
68b0e7620b0e7fa81bb6fc791dc61ad0e142c55ede9c69a3993945538796778c.exe
Size 1.7MB
Sample241113-v1mcrawdrf
SHA256 68b0e7620b0e7fa81bb6fc791dc61ad0e142c55ede9c69a3993945538796778c
MD5 b6ccdc08f3a4d162402f683042146ff6
SHA1 06f5defb216002c2350a884f8d3469d33d8e708a
SHA512 54fb3752253f6eccd19bac7f61168a304b2a79043ed12d45d9948a47244d73bec09b8ed85c54eb61daf293da471d3bd84656e6b77d9ee5635fd411c01fb77946
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQ9i:GemTLkNdfE0pZyB
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1216	68b0e7620b0e7fa81bb6fc791dc61ad0e142c55ede9c69a3993945538796778c.exe
Token: SeLockMemoryPrivilege	1216	68b0e7620b0e7fa81bb6fc791dc61ad0e142c55ede9c69a3993945538796778c.exe

C:\Users\Admin\AppData\Local\Temp\68b0e7620b0e7fa81bb6fc791dc61ad0e142c55ede9c69a3993945538796778c.exe
"C:\Users\Admin\AppData\Local\Temp\68b0e7620b0e7fa81bb6fc791dc61ad0e142c55ede9c69a3993945538796778c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1216