547423fcd0fd56fddcc3fae4f364fd14a972f4704ec0babeb37cfde1dbadd49f | Triage

Analysis

max time kernel
149s
max time network
43s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
25-07-2022 19:15

Sharing

Report Analysis Logs

General

Target

547423fcd0fd56fddcc3fae4f364fd14a972f4704ec0babeb37cfde1dbadd49f.exe
Size

17KB
MD5

c7f4677ac9c92ec3bada199a18fb7ac8
SHA1

aa64ea570faba4b8efa0a43f4c9ce964ff19eb39
SHA256

547423fcd0fd56fddcc3fae4f364fd14a972f4704ec0babeb37cfde1dbadd49f
SHA512

44f74f7fce763b86b5374723208ac25439a7babffdc7eef43152445af0aef3e0baa21e55235e5eee201c34049af34bdee210e3c05708e1a1315563ddd12e499b

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

547423fcd0fd56fddcc3fae4f364fd14a972f4704ec0babeb37cfde1dbadd49f.exe

description pid process

Token: SeDebugPrivilege 944 547423fcd0fd56fddcc3fae4f364fd14a972f4704ec0babeb37cfde1dbadd49f.exe

C:\Users\Admin\AppData\Local\Temp\547423fcd0fd56fddcc3fae4f364fd14a972f4704ec0babeb37cfde1dbadd49f.exe
"C:\Users\Admin\AppData\Local\Temp\547423fcd0fd56fddcc3fae4f364fd14a972f4704ec0babeb37cfde1dbadd49f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/944-54-0x000007FEF3810000-0x000007FEF4233000-memory.dmp

Filesize
10.1MB

Download
memory/944-55-0x000007FEF2770000-0x000007FEF3806000-memory.dmp

Filesize
16.6MB

Download