4fc79d9682b93848b14d94d14d88fb7e6cb12e1334da2a3139a5dc442a10364e

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 21:30

Target
injector (1).exe
Size 580KB
Sample261012-1crv8a1vds
SHA256 4fc79d9682b93848b14d94d14d88fb7e6cb12e1334da2a3139a5dc442a10364e
MD5 48dc38ab04fbf53f686110bd629bf236
SHA1 6825639e93d3d642a5a77c677e8e755472916160
SHA512 339c5b47c87d749b2375acafdce0ea60e7686b20f3209bee65f681ae27c17a09a1bb853345c7ae25d34602595d38df4b7f0eec3d7052c05d918bc41a4937bcb3
SSDEEP 6144:e5fV6uaZsiyR3aUNz1R1woc4J4RXp7hw5Mve2Nn6Sjr0BHUWq+9yN86IpKIGl9AZ:e5fusiyRZ8NhYQF7SHh89QMKQjhu
TLSH
T1CCC4C68326EB0CE6DD932B7D25DFA3366735FE708B2A4B6B4204C1312C135D56D6AB90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2908	injector (1).exe
Token: SeRestorePrivilege	2908	injector (1).exe
Token: SeBackupPrivilege	2908	injector (1).exe
Token: SeSecurityPrivilege	2908	injector (1).exe

C:\Users\Admin\AppData\Local\Temp\injector (1).exe
"C:\Users\Admin\AppData\Local\Temp\injector (1).exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2772

memory/2908-0-0x00007FF6565F0000-0x00007FF656639000-memory.dmp

Download