413df54020a07f08c1f1155d3a6673354016fc5c2cc000639a5d0f2927818635 | Triage

Analysis

max time kernel
146s
max time network
170s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12-10-2022 15:25

Sharing

Report Analysis Logs

General

Target

b1e22a24ebb0db8b15c9afc6d23679ea.exe
Size

23KB
MD5

b1e22a24ebb0db8b15c9afc6d23679ea
SHA1

f65c0f8fd0ac954b116cffbc26ade226269bf738
SHA256

413df54020a07f08c1f1155d3a6673354016fc5c2cc000639a5d0f2927818635
SHA512

6308da0bfb059c50e2736b325b7ea784a0b26b2a549045cdb2b0aa13e568577f96e23f55be354c770cbb1825c04c12c7c3ee3de9c963b0e1f69d5b32f25b7afb
SSDEEP

384:thfPn2EZ4L0yMJLpLgLPLEsLffOSvNTcI1pGIB0PREg:thBZs+tkDEsKqaIB09

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b1e22a24ebb0db8b15c9afc6d23679ea.exe

description pid process

Token: SeDebugPrivilege 1848 b1e22a24ebb0db8b15c9afc6d23679ea.exe

C:\Users\Admin\AppData\Local\Temp\b1e22a24ebb0db8b15c9afc6d23679ea.exe
"C:\Users\Admin\AppData\Local\Temp\b1e22a24ebb0db8b15c9afc6d23679ea.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1848-54-0x0000000000EA0000-0x0000000000EAC000-memory.dmp

Filesize
48KB

Download
memory/1848-55-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download