4851685f4968f602265bf0ddd158d3d5446f0971f7c6d23608187ada1005788d

Analysis

max time kernel
105s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/11/2024, 03:13

Target
4851685f4968f602265bf0ddd158d3d5446f0971f7c6d23608187ada1005788d.exe
Size 1.8MB
Sample241114-dqsncaxmbq
SHA256 4851685f4968f602265bf0ddd158d3d5446f0971f7c6d23608187ada1005788d
MD5 98046b9907fbcd7de99eba59e93496ef
SHA1 05c2e6b221b97fb795fcb2dd264992c30afe7dda
SHA512 c83d24670b0860a2e071ce6d78bcc24892b811487fa83f1a5fb3b62f50b2b932aca26c140cb83b253c6b0c57839d08a27c6610debd8b073fc16fe723bee60cc9
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQmnVwY9dOfR:GemTLkNdfE0pZyU
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2064	4851685f4968f602265bf0ddd158d3d5446f0971f7c6d23608187ada1005788d.exe
Token: SeLockMemoryPrivilege	2064	4851685f4968f602265bf0ddd158d3d5446f0971f7c6d23608187ada1005788d.exe

C:\Users\Admin\AppData\Local\Temp\4851685f4968f602265bf0ddd158d3d5446f0971f7c6d23608187ada1005788d.exe
"C:\Users\Admin\AppData\Local\Temp\4851685f4968f602265bf0ddd158d3d5446f0971f7c6d23608187ada1005788d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2064