16bbdb339173d25b4332b377da96e80809aabfe6739cf35d5e70484f08cfdc42

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 02:30

Target
Dism++x64.exe
Size 1.0MB
Sample260809-cy7a2aydpb
SHA256 16bbdb339173d25b4332b377da96e80809aabfe6739cf35d5e70484f08cfdc42
MD5 a1a058ff98dc1f9320195b398aa06167
SHA1 d974136e6dc4b1726b50a770ec8d6f0f4fc859a7
SHA512 8517354f8579905a5ff1b581aee79ac4632d83bf1672490b653caf5807e902745ae1df109083ea895ac63f0a106786390d5e769a220dc21af8f8a7a9585dddc8
SSDEEP 12288:KU4qFPGYdX6h867AoanHh8HcMcv1mFwPxEeGzAS3pQYQYa8I1HwJVKC2+RQ:KRqFLqaB88F8SYzAS3dQYa8I1HGbi
TLSH
T1E9355A0633F804DCD5A78179CA128B2FF6B1BA835A21D2CF416586C55F3FA634D2EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeBackupPrivilege	3124	Dism++x64.exe
Token: SeRestorePrivilege	3124	Dism++x64.exe

C:\Users\Admin\AppData\Local\Temp\Dism++x64.exe
"C:\Users\Admin\AppData\Local\Temp\Dism++x64.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3124