6c6d04b9d2191a82613f7572d0211075066ba679e1e53c2d1ca190de8bcc7eb5 | Triage

Analysis

max time kernel
41s
max time network
115s
platform
windows7_x64
resource
win7-20220414-en
submitted
24-06-2022 09:12

Sharing

Report Analysis Logs

General

Target

4d96ddab9510a95c16d2c8675e5c2ba3.exe
Size

511KB
MD5

4d96ddab9510a95c16d2c8675e5c2ba3
SHA1

3f006d01c1deffe37f54b438da3449b004a585dd
SHA256

6c6d04b9d2191a82613f7572d0211075066ba679e1e53c2d1ca190de8bcc7eb5
SHA512

0938e3da12d33645e66a3ccaad487c61412df8308c7085e108640ed48e187d7f0ef9a311ce230bd509917c73b3f54b577b8ea212dab73c288c9c148fdd826dfd

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4d96ddab9510a95c16d2c8675e5c2ba3.exe

description pid process

Token: SeDebugPrivilege 1696 4d96ddab9510a95c16d2c8675e5c2ba3.exe

C:\Users\Admin\AppData\Local\Temp\4d96ddab9510a95c16d2c8675e5c2ba3.exe
"C:\Users\Admin\AppData\Local\Temp\4d96ddab9510a95c16d2c8675e5c2ba3.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1696-54-0x0000000000030000-0x00000000000B6000-memory.dmp

Filesize
536KB

Download
memory/1696-55-0x0000000075371000-0x0000000075373000-memory.dmp

Filesize
8KB

Download
memory/1696-56-0x0000000004B25000-0x0000000004B36000-memory.dmp

Filesize
68KB

Download
memory/1696-57-0x0000000004B25000-0x0000000004B36000-memory.dmp

Filesize
68KB

Download