b97235d8902bd007af1d30ab8de02882959b966f33a3fbe5b6251bf51264ad1a

Analysis

user interaction
yes
max time kernel
116s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 08:51

Target
mssyncsvc.exe
Size 963KB
Sample260703-ksemtsd191
SHA256 b97235d8902bd007af1d30ab8de02882959b966f33a3fbe5b6251bf51264ad1a
MD5 f3009684e48916d1b8679a7e8f0af07d
SHA1 36441340376d5307d7f1fe83c05b50188a6151fb
SHA512 0edaa0c49e48d3833be65c8cf0da93e2294be530f5c00e18c693608d33eb3b5d0a878c605bca0e7af2cf2a04b9a391353a8a54b3419707fcbe0f7867250b4446
SSDEEP 24576:+MTbzQpyMgO7Gb+5322HTLptJdTAkgO4Y5X:+Ez/MgO7GbU3tHlz3
TLSH
T1E8253B2A6A5C00ACD1B2D5F8DA275903E671788A03357DEF07D05DB21E176A8AB3FF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4508	mssyncsvc.exe
Token: SeLoadDriverPrivilege	4508	mssyncsvc.exe
Token: SeLoadDriverPrivilege	4508	mssyncsvc.exe
Token: SeLoadDriverPrivilege	4508	mssyncsvc.exe
Token: SeLoadDriverPrivilege	4508	mssyncsvc.exe
Token: SeLoadDriverPrivilege	4508	mssyncsvc.exe

C:\Users\Admin\AppData\Local\Temp\mssyncsvc.exe
"C:\Users\Admin\AppData\Local\Temp\mssyncsvc.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4508