Analysis
-
max time kernel
495s -
max time network
504s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
12-07-2023 04:15
General
-
Target
3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767.exe
-
Size
114KB
-
MD5
decc2726599edcae8d1d1d0ca99d83a6
-
SHA1
0d8cc992f279ec45e8b8dfd05a700ff1f0437f29
-
SHA256
3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767
-
SHA512
1096ccabe0c99ab73bbc92c645814b6590f5a925801eb3a97e9930e3bc668738f8852e83628474836ba15983b6660eb5c2f2741e925d16877991ca89be47f49a
-
SSDEEP
1536:bV3+WmNcWDurilmw9BgjKu1sPPxaS4jqY:bV3+WmjDxlPwV16PkS4jqY
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 3 IoCs
-
Suspicious behavior: LoadsDriver 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767.exe"C:\Users\Admin\AppData\Local\Temp\3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767.exe"1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵