6b2bfd934eb3ac332b909ed957468e7e74869c424c92a28995f30e8a46f3bad5 | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20-05-2022 04:05

Sharing

Report Analysis Logs

General

Target

6b2bfd934eb3ac332b909ed957468e7e74869c424c92a28995f30e8a46f3bad5.exe
Size

16KB
MD5

65b1180b492002ebc48630e892176aa9
SHA1

e5124246076b02e6e72205d1520352322b06c0db
SHA256

6b2bfd934eb3ac332b909ed957468e7e74869c424c92a28995f30e8a46f3bad5
SHA512

dd465ca226250f5329cbf6bb58a946a4efb06b0944ada3db7e2347dcd85b10c0eaef0a2ae41ee48465cd9ffa7d77409c3944516cb56a7aa73eb201ddebad9ee7

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6b2bfd934eb3ac332b909ed957468e7e74869c424c92a28995f30e8a46f3bad5.exe

description pid process

Token: SeDebugPrivilege 4684 6b2bfd934eb3ac332b909ed957468e7e74869c424c92a28995f30e8a46f3bad5.exe

C:\Users\Admin\AppData\Local\Temp\6b2bfd934eb3ac332b909ed957468e7e74869c424c92a28995f30e8a46f3bad5.exe
"C:\Users\Admin\AppData\Local\Temp\6b2bfd934eb3ac332b909ed957468e7e74869c424c92a28995f30e8a46f3bad5.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:3852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4684-130-0x00007FFB54150000-0x00007FFB54B86000-memory.dmp

Filesize
10.2MB

Download