Analysis
-
max time kernel
129s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 01:06
Static task
static1
Behavioral task
behavioral1
Sample
46881e86cabd9d39cb7b57e9a85f2007c1c8fece41e3b5edd74c12f38c4acba9.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
46881e86cabd9d39cb7b57e9a85f2007c1c8fece41e3b5edd74c12f38c4acba9.exe
Resource
win10v2004-20240419-en
General
-
Target
46881e86cabd9d39cb7b57e9a85f2007c1c8fece41e3b5edd74c12f38c4acba9.exe
-
Size
36KB
-
MD5
50ee68942ea8bb92caec46f64d21c425
-
SHA1
6bf4dd3cf4c58a212473c819148ec2bd4710bae7
-
SHA256
46881e86cabd9d39cb7b57e9a85f2007c1c8fece41e3b5edd74c12f38c4acba9
-
SHA512
48967574b9577c81470ebe520ddd2beff40e4b2847e5e89a1eacb12d653fe1452826f18e40a6ec6328782827f0f9ba6f1eb23d295628632f2fee8c74c6c5c228
-
SSDEEP
384:Gd1IDSKDQbkoKDVbJdpGKDGPGAWoNyb8E9VF6IYinAM+oP9YkB/5OtMh:WQ39EPGHAEpYinAMxhBTh
Malware Config
Signatures
-
Detects executables packed with SmartAssembly 1 IoCs
resource yara_rule behavioral1/memory/2364-1-0x00000000002A0000-0x00000000002AA000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2364 46881e86cabd9d39cb7b57e9a85f2007c1c8fece41e3b5edd74c12f38c4acba9.exe