c92a121ec9829988f3b22328470df3d548f03a3970335694b50206676afaeb7e | Triage

Analysis

max time kernel
121s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-03-2024 07:36

Sharing

Report Analysis Logs

General

Target

publish/Ryujinx.exe
Size

57.1MB
MD5

c549f9b0b42d339dccc7d0ca01050e2d
SHA1

6992a948b69a1ca8bb9c5439224667abff119714
SHA256

ca90ab3fbb660c5a562967786414fbf7ecb0c4579c77c4a353cad7c130505d57
SHA512

58ee0eb67787636ed7ba8ab8edc9d1bfb8f71fb65bb34da06942880397103368c07377da2afe698d348721865967faced97b07653d96b5b386e239871c864868
SSDEEP

393216:9G251FGAsxevvPx3GrGLODPYMOBz0E/su+0BY2M8U:9D1Ftx3Gr8ODPwsOBY2Mz

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2464	Ryujinx.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2860	2464	Ryujinx.exe	30
PID 2464 wrote to memory of 2860	2464	Ryujinx.exe	30
PID 2464 wrote to memory of 2860	2464	Ryujinx.exe	30

C:\Users\Admin\AppData\Local\Temp\publish\Ryujinx.exe
"C:\Users\Admin\AppData\Local\Temp\publish\Ryujinx.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2464 -s 1156
  2⤵
  PID:2860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2464-0-0x000000013F620000-0x000000013FF8D000-memory.dmp

Filesize
9.4MB

Download
memory/2464-2-0x000000013F620000-0x000000013FF8D000-memory.dmp

Filesize
9.4MB

Download