36f869e72de128a607f2ab71cd258fe72d571352f9d30ba72375175541b31c52

Analysis

max time kernel
105s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/11/2024, 04:25

Target
36f869e72de128a607f2ab71cd258fe72d571352f9d30ba72375175541b31c52.exe
Size 1.4MB
Sample241114-e189hstnct
SHA256 36f869e72de128a607f2ab71cd258fe72d571352f9d30ba72375175541b31c52
MD5 a983ef58744988a8e0823a81c502cf7c
SHA1 b2f6a072b9a7a652179967b70d81cd713d986c7c
SHA512 d0a4f32a877cb76a973e27000ddf4afc4df3087e347344f10dbbf4d625c9631de9e7664de1252b603e8e46470de889f5fff366a503118147f13ae83584e7f581
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5QbPrQtOQzg:GezaTF8FcNkNdfE0pZ9ozttwIRx2T9co
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4040	36f869e72de128a607f2ab71cd258fe72d571352f9d30ba72375175541b31c52.exe
Token: SeLockMemoryPrivilege	4040	36f869e72de128a607f2ab71cd258fe72d571352f9d30ba72375175541b31c52.exe

C:\Users\Admin\AppData\Local\Temp\36f869e72de128a607f2ab71cd258fe72d571352f9d30ba72375175541b31c52.exe
"C:\Users\Admin\AppData\Local\Temp\36f869e72de128a607f2ab71cd258fe72d571352f9d30ba72375175541b31c52.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4040