4e91dc14d0580ab07a63425e9c868b4f1d0f1a75fc1ec937b7081782443e2085 | Triage

Analysis

max time kernel
149s
max time network
180s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
20-07-2022 17:12

Sharing

Report Analysis Logs

General

Target

4e91dc14d0580ab07a63425e9c868b4f1d0f1a75fc1ec937b7081782443e2085.exe
Size

16KB
MD5

12eccb51e97308e9e6cb0b528872bc39
SHA1

8f9225c42aef64e1dc1ce142d2b099b7f22b7e95
SHA256

4e91dc14d0580ab07a63425e9c868b4f1d0f1a75fc1ec937b7081782443e2085
SHA512

f384e301a820499f51a9e7bfd57d77d91a6550fdfa148c9d6efc33fdd0397f215a613ef599b1783601e195ef15f3bd4ceb409d0e0e49a940de93d9851f2f4154

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4e91dc14d0580ab07a63425e9c868b4f1d0f1a75fc1ec937b7081782443e2085.exe

description pid process

Token: SeDebugPrivilege 1020 4e91dc14d0580ab07a63425e9c868b4f1d0f1a75fc1ec937b7081782443e2085.exe

C:\Users\Admin\AppData\Local\Temp\4e91dc14d0580ab07a63425e9c868b4f1d0f1a75fc1ec937b7081782443e2085.exe
"C:\Users\Admin\AppData\Local\Temp\4e91dc14d0580ab07a63425e9c868b4f1d0f1a75fc1ec937b7081782443e2085.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1020-54-0x000007FEF3B70000-0x000007FEF4593000-memory.dmp

Filesize
10.1MB

Download
memory/1020-55-0x000007FEF2890000-0x000007FEF3926000-memory.dmp

Filesize
16.6MB

Download