Analysis
-
max time kernel
164s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
04/10/2023, 11:48
General
-
Target
pssuspend.exe
-
Size
282KB
-
MD5
df3d77d41ef28027b3069d39f9ee9c79
-
SHA1
0dfcf31ad455abd48d35b0250b5b03265052fba6
-
SHA256
02ec8c37dd946a2cd74673993c2108f12fff3e82019a1590231c4205ccb2f0d4
-
SHA512
ff9168421ea2e0b56ece4df777b1fa3605cbb4ac81d1c81cf2491a5c197baf67c47ba4d1d767c5c272a8f3cfa46b169234d19b98671ff6ad8f7a092f51e9378d
-
SSDEEP
3072:K/kvkbvka2pVtwouW9+DZUFIPcpGwDmXsBvpRyAHa0MiZUFw/oPACa337yGTkSEh:K/CkboR5INUR94GhnO6g1Co/
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\pssuspend.exe"C:\Users\Admin\AppData\Local\Temp\pssuspend.exe"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB