2ebe3683be875f943118996b61bf62545495fc8d88c39046620aa8514d302930

Analysis

user interaction
yes
max time kernel
149s
max time network
32s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 22:16

Target
infected_new.exe
Size 4.6MB
Sample260531-16wfhahs8z
SHA256 2ebe3683be875f943118996b61bf62545495fc8d88c39046620aa8514d302930
MD5 26d79d2fcbcd4868f3ecd4ed9a0b2e00
SHA1 dd16c0c5b0ce7ff63d26313cc0b4059bb9e60251
SHA512 cf8e19a8888265adbe044bade4bddec76fb15e3090cd9bc986df4127fb9e29c392b7ec0f7d8c7122ae7e8ee8c134f51d6a513fcf1424cbae132f7e13305e3bd6
SSDEEP 49152:9lfHL1kAllUuCSVntV22JMmbjkb3ZKlK1KRd5E1CdeJ/Hcbtm6goLEO5oVgCwcHz:9ljaUpujGE12eJ/HcbtCoLEhgCdB
TLSH
T121269D03EC9559FAC4EEA23189B252537B35BC491B3263DB2B90B6782E73BD05C79314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4016	infected_new.exe
4016	infected_new.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeBackupPrivilege	124	svchost.exe
Token: SeRestorePrivilege	124	svchost.exe
Token: SeSecurityPrivilege	124	svchost.exe
Token: SeTakeOwnershipPrivilege	124	svchost.exe
Token: 35	124	svchost.exe

C:\Users\Admin\AppData\Local\Temp\infected_new.exe
"C:\Users\Admin\AppData\Local\Temp\infected_new.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4016

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:124