Analysis
-
max time kernel
89s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
24-09-2022 23:42
General
-
Target
RAVAntivirus/rsExtensionHost.exe
-
Size
143KB
-
MD5
ffe5b6868c88996aa2f8554506864413
-
SHA1
7ec36d58b71cbfb561c72319ae4ff1834f30d1fa
-
SHA256
47295ec9fb73ef49405f0d74d354212be68d2004fe8250b8aaa3dbf0fc6f151e
-
SHA512
1c3b5c16432d445bf7a8d6b03f862c74ef92c55e4dcc9f83537779b81e59ec819489b0f234a8976573b8f399c5587d8809c954edea557bdec0d86e6128b0413b
-
SSDEEP
3072:xQj0u/GHRd5O/17ObZZ1IAu9a9V4ffc1VyiKoJDbTf:uwuuxPSqLbu9a9mEJzf
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RAVAntivirus\rsExtensionHost.exe"C:\Users\Admin\AppData\Local\Temp\RAVAntivirus\rsExtensionHost.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4480-132-0x000001DFC7770000-0x000001DFC7796000-memory.dmpFilesize
152KB
-
memory/4480-133-0x000001DFC9420000-0x000001DFC9474000-memory.dmpFilesize
336KB
-
memory/4480-134-0x00007FFFDE280000-0x00007FFFDED41000-memory.dmpFilesize
10.8MB
-
memory/4480-135-0x000001DFE28D0000-0x000001DFE2908000-memory.dmpFilesize
224KB
-
memory/4480-136-0x000001DFE2910000-0x000001DFE2968000-memory.dmpFilesize
352KB
-
memory/4480-137-0x000001DFE2970000-0x000001DFE29A2000-memory.dmpFilesize
200KB
-
memory/4480-138-0x000001DFE30E0000-0x000001DFE36F8000-memory.dmpFilesize
6.1MB
-
memory/4480-139-0x000001DFC92E0000-0x000001DFC92F2000-memory.dmpFilesize
72KB
-
memory/4480-140-0x000001DFE29F0000-0x000001DFE2A2C000-memory.dmpFilesize
240KB
-
memory/4480-141-0x000001DFE2BD0000-0x000001DFE2CDA000-memory.dmpFilesize
1.0MB
-
memory/4480-142-0x00007FFFDE280000-0x00007FFFDED41000-memory.dmpFilesize
10.8MB