Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
15-03-2024 20:16
General
-
Target
PaintDotNet.exe
-
Size
2.0MB
-
MD5
da11080e76aa6f6ddaf949dacdf91695
-
SHA1
17739eade33984b9f7728c9e8014f4cb7d09f98f
-
SHA256
e1db30ca7b39d386225b19be53bbf045247c0565072024c9fae2457f256c8a85
-
SHA512
7a13913fd3e28fe1642a439e9a4d9cb5516bce6fd0068aeecb29af1000b98a70fd02e4cc103aed3f3831c75fbb2d73b9027fbc80daf56c469c76e90861afb41a
-
SSDEEP
24576:J/HykHxgVwLB5ziKE+t6LR15OXdvJd2C5O49e5wY8hh:dwcBxiKET4bd2C5f
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PaintDotNet.exe"C:\Users\Admin\AppData\Local\Temp\PaintDotNet.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1112-0-0x0000000011D10000-0x0000000011F18000-memory.dmpFilesize
2.0MB
-
memory/1112-1-0x000007FEF5320000-0x000007FEF5D0C000-memory.dmpFilesize
9.9MB
-
memory/1112-2-0x0000000002020000-0x00000000020B8000-memory.dmpFilesize
608KB
-
memory/1112-3-0x00000000032E0000-0x00000000034E2000-memory.dmpFilesize
2.0MB
-
memory/1112-4-0x00000000036F0000-0x00000000037E0000-memory.dmpFilesize
960KB
-
memory/1112-5-0x00000000037E0000-0x00000000038DC000-memory.dmpFilesize
1008KB
-
memory/1112-6-0x0000000002E50000-0x0000000002ED0000-memory.dmpFilesize
512KB
-
memory/1112-7-0x000007FEF5320000-0x000007FEF5D0C000-memory.dmpFilesize
9.9MB