16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267

max time kernel
244s
max time network
254s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
26-11-2024 23:06

Sharing

Target

New Text Document mod.exe
Size

8KB
MD5

69994ff2f00eeca9335ccd502198e05b
SHA1

b13a15a5bea65b711b835ce8eccd2a699a99cead
SHA256

2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
SHA512

ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3
SSDEEP

96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1700	New Text Document mod.exe

C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1700

memory/1700-0-0x00007FFFCDB53000-0x00007FFFCDB55000-memory.dmp

Filesize
8KB

Download
memory/1700-1-0x0000000000D80000-0x0000000000D88000-memory.dmp

Filesize
32KB

Download
memory/1700-2-0x00007FFFCDB50000-0x00007FFFCE612000-memory.dmp

Filesize
10.8MB

Download
memory/1700-3-0x00007FFFCDB53000-0x00007FFFCDB55000-memory.dmp

Filesize
8KB

Download
memory/1700-4-0x00007FFFCDB50000-0x00007FFFCE612000-memory.dmp

Filesize
10.8MB

Download
memory/1700-5-0x00007FFFCDB50000-0x00007FFFCE612000-memory.dmp

Filesize
10.8MB

Download