2a5405e1725d538ce23417225e97795a0b97dacc2fcae9407b4ca3926d055480 | Triage

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 01:58

Sharing

Report Analysis Logs

General

Target

Recuperar archivos/cygz.dll
Size

299KB
MD5

d8de709dbc5783cdba84bdae674469ac
SHA1

aabae5e1ff4487483df7b4956da177f891afa966
SHA256

78d499f1d956edf00dd988c95f7f76174425c0fb47e3ddb56ba6af447f18f4f1
SHA512

c4d16dc482183fd7891c15c8d96f1c99a65667c778cfcedfd897d885f9fea13a65aea97335c4681e1591b2cfa2b8a72982b2de3d3f66405f41607d26f9451c17
SSDEEP

6144:QvvrjnCh2LHTBOCRkLqDMRFs6iX35rRv9N7FP:QvvW2LHT0CRkLqILiXpB7FP

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2548	rundll32.exe
Token: SeBackupPrivilege	2548	rundll32.exe
Token: SeDebugPrivilege	2548	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Recuperar archivos\cygz.dll",#1
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2548-0-0x0000000597FD0000-0x0000000598020000-memory.dmp

Filesize
320KB

Download
memory/2548-2-0x0000000180040000-0x0000000180650000-memory.dmp

Filesize
6.1MB

Download