Analysis
-
max time kernel
37s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
24-09-2022 23:42
General
-
Target
RAVAntivirus/rsExtensionHost.exe
-
Size
143KB
-
MD5
ffe5b6868c88996aa2f8554506864413
-
SHA1
7ec36d58b71cbfb561c72319ae4ff1834f30d1fa
-
SHA256
47295ec9fb73ef49405f0d74d354212be68d2004fe8250b8aaa3dbf0fc6f151e
-
SHA512
1c3b5c16432d445bf7a8d6b03f862c74ef92c55e4dcc9f83537779b81e59ec819489b0f234a8976573b8f399c5587d8809c954edea557bdec0d86e6128b0413b
-
SSDEEP
3072:xQj0u/GHRd5O/17ObZZ1IAu9a9V4ffc1VyiKoJDbTf:uwuuxPSqLbu9a9mEJzf
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RAVAntivirus\rsExtensionHost.exe"C:\Users\Admin\AppData\Local\Temp\RAVAntivirus\rsExtensionHost.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2044-54-0x0000000000C30000-0x0000000000C56000-memory.dmpFilesize
152KB
-
memory/2044-55-0x0000000000410000-0x0000000000464000-memory.dmpFilesize
336KB
-
memory/2044-56-0x0000000000470000-0x00000000004A8000-memory.dmpFilesize
224KB
-
memory/2044-57-0x00000000005A0000-0x00000000005F8000-memory.dmpFilesize
352KB
-
memory/2044-58-0x0000000000540000-0x0000000000572000-memory.dmpFilesize
200KB
-
memory/2044-59-0x000000001B3F0000-0x000000001B9F6000-memory.dmpFilesize
6.0MB