c6c4e6a70a1a5eeb9427002eb5a8dfd00ed4f27ea3dc8bbd0dca975f00e61e24

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 20:05

Target
sysprot.exe
Size 53KB
Sample260517-yttp2agv5n
SHA256 c6c4e6a70a1a5eeb9427002eb5a8dfd00ed4f27ea3dc8bbd0dca975f00e61e24
MD5 6810417b61e5620828061c985a6794bc
SHA1 85030268784109e9f12ecf1fadf500ad23c48ef3
SHA512 99c9f6f69fa425e1e6b73f10ba9e79843ac161daab8af816517a250ea76d8eeb36d2de47d6b8deee1eacac5c69c852285ec3a4f374439827a882e85282d3d74d
SSDEEP 1536:posOisos9sAwDBs9Q9olwySDWdeTPwdkzMe:poJiss9kSDgeT9Z
TLSH
T15343AF91D7B844CEFD0A857E9620C613AC30FB860B61A4EF5393A1292E94FF1DB395D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3252	sysprot.exe

C:\Users\Admin\AppData\Local\Temp\sysprot.exe
"C:\Users\Admin\AppData\Local\Temp\sysprot.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3252