9f83690b4ba738a40f8993645d5d02d3fda46041bf93a97cbde487fe09e3bb86 | Triage

Analysis

max time kernel
117s
max time network
135s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 03:25

Sharing

Report Analysis Logs

General

Target

EasyHookSvc.exe
Size

8KB
MD5

642338e293ae96e6f43a003b7c5041aa
SHA1

b610830981b76883d477ef3f43546e4460bd8f75
SHA256

65492608f5da52ed8d5b6f9360b6d9792456802e6fb03adf38656223501a923a
SHA512

efa34dc88ccf73418b78121721eaa1c26865b30dc36e953d4ac5c74af3b2a8caa9fbdf0fc681b966e297309e262caa4b78139a161850b3d1277fc302fe4f2eb4
SSDEEP

192:qfbEkWW2wQ9bLcK9xs3+ETZrOnVSuGWFsClKHGzF:6b4HH9btfs3+ElrG06sClKmz

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

EasyHookSvc.exe

description pid process

Token: SeDebugPrivilege 2280 EasyHookSvc.exe

C:\Users\Admin\AppData\Local\Temp\EasyHookSvc.exe
"C:\Users\Admin\AppData\Local\Temp\EasyHookSvc.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2280

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2280-0-0x000000007425E000-0x000000007425F000-memory.dmp

Filesize
4KB

Download
memory/2280-1-0x00000000008B0000-0x00000000008B8000-memory.dmp

Filesize
32KB

Download
memory/2280-2-0x0000000000420000-0x0000000000434000-memory.dmp

Filesize
80KB

Download
memory/2280-3-0x0000000074250000-0x000000007493E000-memory.dmp

Filesize
6.9MB

Download