2835817ed9cbf43ebd0939b500d85b46a9ffaa858aaf54b7b495558c7c95bbc8

Analysis

max time kernel
0s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 13:04

Reason

Machine shutdown

Target
csharpBSOD.exe
Size 15.8MB
Sample260531-qa2brsbs2m
SHA256 2835817ed9cbf43ebd0939b500d85b46a9ffaa858aaf54b7b495558c7c95bbc8
MD5 2a3a3cbf590b66d6421644aaf6cc7bc5
SHA1 6a9e3af060f0b15a37634acfbe7f63867bc42a47
SHA512 3a170aea2c660af45abb3b7ffb7f49c2cb2d553e63155bab77e1b5f163f582bb8535c6a24937010712857c21ac20b5982078f55670925f906310bdfb11864219
SSDEEP 393216:L7eLd/nhouIETpkFh3KNl5zGa1tlyGXHpmjgM5VvxVEVt9lTLx2AwvWFbQdVz00o:eLd/W6Nl5zX
TLSH
T180F6AE16F3E801A8E57FC27CC6674617EBB27495132097DB09548A6A2F23FD1AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2904	csharpBSOD.exe

C:\Users\Admin\AppData\Local\Temp\csharpBSOD.exe
"C:\Users\Admin\AppData\Local\Temp\csharpBSOD.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2904