026fcc119a1bb6114d05c70d30107fb266e2c4ac98b1d6154f69bf27cee30cfc

Analysis

user interaction
yes
max time kernel
130s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 21:09

Target
loader.exe
Size 106KB
Sample260706-zzhemagy2q
SHA256 026fcc119a1bb6114d05c70d30107fb266e2c4ac98b1d6154f69bf27cee30cfc
MD5 d80d0396d178d8c8aa428cfbedf7bd5c
SHA1 7ee7c06fd8a00c813d2a41af232ace14f37c3943
SHA512 67af3e55ab3abd8c9e4ff7241a0682e46aad9196ccc7fea42b5df259de3535749892fbbe8ddf75bc554b73455aeb98dc759802657e9d5053105bef7f757be81e
SSDEEP 1536:+u2Gg/5xT1PMsvbr5NfiPHQRMspLve8VqNEM1IcAemMnGMVIqT:RNgjBtvbr5NfiPHgM6XsxIq
TLSH
T17DB32A37EA1900AED266D9B4DA665D02D771BCCA03716BCF53806CE60F2A1D85F3FA11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1284	loader.exe

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1284

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5304