bab696c1af9fd7dc635b4a1e5a8893481b897e24d913f6ae23cf0d3aa8d515fd

Analysis

user interaction
yes
max time kernel
0s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
26/10/2026, 22:31

Target
sample.rar
Size 212.3MB
Sample261026-2fmlcahx9k
SHA256 bab696c1af9fd7dc635b4a1e5a8893481b897e24d913f6ae23cf0d3aa8d515fd
MD5 95cf1f4be3469e1527678363c981b10c
SHA1 6e79e4b6db93d20320cfd611acbd6ddb2247f0bd
SHA512 478fbea9ffd02afbcbe5e981c37460d1225aaedb66383c8951694b1461aac93c02cacc2567eded21a2f94a44982a7f3fa9334e1428457e91e92d8e67b80c7f95
SSDEEP 3145728:Zt8mzDXxfBKnWcT0Yf10zS+eQePsxfQggIEK0V3qbYSOA4fvPlVQdnrtCNuTDoZv:vlr6N8S/dqfQgg8JMpA4NVKnpCs4t8GP
TLSH
T152B833E67DB1CB2B35000A7C17E619A2A7B1B35643FD34ED0593813A0BC565EE27B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	5432	7zFM.exe
Token: 35	5432	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\sample.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5432