daa3e138c21b572cb7955ee35f2fb1398b47313837c73f5999a385e1957bc392

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 04:37

Target
x64/ExtraBypass.dll
Size 133KB
Sample260701-e8wndsev2r
SHA256 daa3e138c21b572cb7955ee35f2fb1398b47313837c73f5999a385e1957bc392
MD5 f808357eb75ce997e02ed7c936f33b81
SHA1 94eb0afd7193de15f94d5788a8b56e65933b2683
SHA512 ee3b8a35183a29edf1f699bcb00463fae1d6ce0227616b90ef13979f18025ed26f4441055e872b625e87fcedfd35951467d104fab97856190a77c62d5178f280
SSDEEP 3072:y/Mc90jGyW2CAqrC3Q8S+vEyBUB+5vnA8wvsl:yUO0jGE9qrwQ2NVpevsl
TLSH
T151D36C47B7B410BFE4778274C8D30A12D7B6B8251B609B9F07A046592F237E19D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5104	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x64\ExtraBypass.dll,#1
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5104