da0c5c185b5b06fd65cc65d6baf9174f68dedcc4c1591736126416a3b89bf667

Analysis

geolocation tags

eueuropelondonukunited-kingdom
max time kernel
899s
max time network
510s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 08:41

Target
VeloStrap.exe
Size 15.3MB
Sample260708-kljcfaew3k
SHA256 da0c5c185b5b06fd65cc65d6baf9174f68dedcc4c1591736126416a3b89bf667
MD5 58eee8548bb0ec4aa8809e8d17ee7f9d
SHA1 56eaf6f280671a9198ea511e115e2be65f01d420
SHA512 db144a0141c3b6877dd712ec744a00e6d8f4a465596e348e6b1874753448a1928b3b476e4bb89781e5470506c3d5accd1b942005218460509884c9703c435fd4
SSDEEP 98304:6dlJhHIAUxdS+TsNYasWmc1BsGE+ZmD3tSOYoHwfLk3vSmaR0+Mc4AN0edaAHDff:63/HDU24sfsWVLsh+ZJObAbN0E
TLSH
T157F67D4523FC2635E3F74B35A970621A4D76BC1AA912D78E1B887A1D1A72780CCF0B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1104	VeloStrap.exe

C:\Users\Admin\AppData\Local\Temp\VeloStrap.exe
"C:\Users\Admin\AppData\Local\Temp\VeloStrap.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3356

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3652