2ecfa6b2860ea88e201191b4d356120818d5ea139179b4bcd23d8cc9d31d5d88

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 14:02

Target
2ecfa6b2860ea88e201191b4d356120818d5ea139179b4bcd23d8cc9d31d5d88.exe
Size 1.5MB
Sample260424-rb643sc13j
SHA256 2ecfa6b2860ea88e201191b4d356120818d5ea139179b4bcd23d8cc9d31d5d88
MD5 ff1d59ee9f20ce4bd9b98ae03fafe146
SHA1 b94d29ce3f62d7e00952e923d5ffb54a3475710f
SHA512 43aae9a9208c28efbb708e7a985e724997ef3461fac87e77fb4ac5d1dcc7a5012826936ef464dc4ce1cf566c9f061f10949c206f79796af0ebd93247c2bacaee
SSDEEP 24576:OzzbrxTYlojCT9UcIvK0kxnqW/KA/4HbjagNZnsnPjmiTyEkZxSOoRNF7r6cn/:0zntxu8C7fx4XjNZXiTuuX6o
TLSH
T112759D46F3A680D9D4ABC571CA52863BFB703849813897A757A4CF622F33761E63D312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	1308	2ecfa6b2860ea88e201191b4d356120818d5ea139179b4bcd23d8cc9d31d5d88.exe
Token: SeRestorePrivilege	1308	2ecfa6b2860ea88e201191b4d356120818d5ea139179b4bcd23d8cc9d31d5d88.exe
Token: 33	1308	2ecfa6b2860ea88e201191b4d356120818d5ea139179b4bcd23d8cc9d31d5d88.exe
Token: SeIncBasePriorityPrivilege	1308	2ecfa6b2860ea88e201191b4d356120818d5ea139179b4bcd23d8cc9d31d5d88.exe

C:\Users\Admin\AppData\Local\Temp\2ecfa6b2860ea88e201191b4d356120818d5ea139179b4bcd23d8cc9d31d5d88.exe
"C:\Users\Admin\AppData\Local\Temp\2ecfa6b2860ea88e201191b4d356120818d5ea139179b4bcd23d8cc9d31d5d88.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1308

memory/1308-0-0x0000000000730000-0x00000000007CB000-memory.dmp

Download