4e3b294d7d094f9958837bd2977bb33efcda944db090b57f32c28a2af5bb5ac7

Analysis

max time kernel
92s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 13:38

Target

4e3b294d7d094f9958837bd2977bb33efcda944db090b57f32c28a2af5bb5ac7.exe
Size

1.2MB
MD5

86312950455fd9b3b88a884dc384d094
SHA1

c0f91ec274eb3e1efe676ee03a83c6f5b974193e
SHA256

4e3b294d7d094f9958837bd2977bb33efcda944db090b57f32c28a2af5bb5ac7
SHA512

95f7049f49964abca6bd0e9584109942c19674619285c0e854e00119e50d83dcfa81ff4effcdc32274ec56fe9e78bc1b6c4856d79274bbeddb96792928aa7d21
SSDEEP

24576:Olv3yIUPE1Bubmq3nT6j31SkQ/7Gb8NLEbeZS:OlfyIUPE1BuB3ujokQ/qoLEwS

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	844	4e3b294d7d094f9958837bd2977bb33efcda944db090b57f32c28a2af5bb5ac7.exe

C:\Users\Admin\AppData\Local\Temp\4e3b294d7d094f9958837bd2977bb33efcda944db090b57f32c28a2af5bb5ac7.exe
"C:\Users\Admin\AppData\Local\Temp\4e3b294d7d094f9958837bd2977bb33efcda944db090b57f32c28a2af5bb5ac7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:844

memory/844-0-0x0000000140000000-0x000000014013A000-memory.dmp

Filesize
1.2MB

Download
memory/844-1-0x0000000000220000-0x0000000000280000-memory.dmp

Filesize
384KB

Download
memory/844-10-0x0000000000220000-0x0000000000280000-memory.dmp

Filesize
384KB

Download
memory/844-11-0x0000000000220000-0x0000000000280000-memory.dmp

Filesize
384KB

Download
memory/844-13-0x0000000140000000-0x000000014013A000-memory.dmp

Filesize
1.2MB

Download