5578f846599a570afc23bf6bdaca80ff8fb4c1b3ab56bf2b11b35d733819cfde | Triage

Analysis

max time kernel
128s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2023, 20:14

Sharing

Report Analysis Logs

General

Target

Valyse.exe
Size

3.2MB
MD5

e4ae7b7c175e61eaa35712911792c9ae
SHA1

6d905bacac7fda40ad0caa538b0334a981df9625
SHA256

5578f846599a570afc23bf6bdaca80ff8fb4c1b3ab56bf2b11b35d733819cfde
SHA512

0f29304e94016b16702c2a6b3d7be0248e341958f45637d2400233e5f42acc5ff446f17e032849b4683343ea00e5debe8d1a4c37cdc40551afd30c2ad5032b2a
SSDEEP

49152:s1AZWj/JWUndP5PfiTIi+H7lwJWm/fMCrqtLE7HKrdD9dJ8D2Lh6:s1AZWPviThoSH/fvrqtLu8z8DB

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1012	Valyse.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1012	Valyse.exe

C:\Users\Admin\AppData\Local\Temp\Valyse.exe
"C:\Users\Admin\AppData\Local\Temp\Valyse.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1012-133-0x0000000000F30000-0x0000000001268000-memory.dmp

Filesize
3.2MB

Download
memory/1012-134-0x0000000005D10000-0x0000000005D20000-memory.dmp

Filesize
64KB

Download