Triage Workbench

Review AI-surfaced anomaly findings and artifact artifacts.

Image:L3

Anomaly Findings

5 findings

CriticalHidden Process Detectedprocessf-001

Process svchost.exe (PID 4821) found in memory but absent from OS process list — classic DKOM rootkit indicator.

Mar 11, 09:18 AM

HighSuspicious Memory Injectionmemory regionf-002

shellcode-like entropy (7.98) detected in notepad.exe (PID 2240) private memory region at 0x00400000.

Mar 11, 09:19 AM

HighUnsigned Kernel Driver Loadeddriverf-003ESCALATED

Driver maldrv.sys found in kernel module list. No valid Authenticode signature. SHA-256 matches known malware family (Lazarus APT).

Mar 11, 09:20 AM

MediumSuspicious Network Socketnetwork socketf-004

chrome.exe (PID 8844) has established connection to 185.220.101.47:4444 — Tor exit node. No user browsing activity correlated.

Mar 11, 09:21 AM

LowStale Authentication Tokenprocessf-005RESOLVED

Kerberos TGT for user administrator@corp.local found in LSASS memory. Token issued 18 days ago — beyond default 10-day lifetime.

Mar 11, 09:22 AM

PID	Name	PPID	User	Memory	Path	Flags
4	System	0	SYSTEM	1MB	—
372	smss.exe	4	SYSTEM	2MB	C:\Windows\System32\smss.exe
528	csrss.exe	520	SYSTEM	8MB	C:\Windows\System32\csrss.exe
604	wininit.exe	520	SYSTEM	5MB	C:\Windows\System32\wininit.exe
824	services.exe	604	SYSTEM	11MB	C:\Windows\System32\services.exe
832	lsass.exe	604	SYSTEM	22MB	C:\Windows\System32\lsass.exe
1092	svchost.exe	824	SYSTEM	30MB	C:\Windows\System32\svchost.exe
1204	svchost.exe	824	LOCAL SERVICE	18MB	C:\Windows\System32\svchost.exe
2240	notepad.exe	3120	jsmith	148MB	C:\Windows\System32\notepad.exe	SUSP
3120	explorer.exe	2996	jsmith	72MB	C:\Windows\explorer.exe
4821	svchost.exe	824	SYSTEM	42MB	C:\Windows\System32\svchost.exe	HIDDEN
5544	cmd.exe	4821	SYSTEM	6MB	C:\Windows\System32\cmd.exe	HIDDEN
7712	powershell.exe	5544	SYSTEM	94MB	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	HIDDEN
8844	chrome.exe	3120	jsmith	210MB	C:\Program Files\Google\Chrome\Application\chrome.exe	SUSP
9128	whelper.exe	1092	jsmith	14MB	C:\Users\jsmith\AppData\Local\Temp\whelper.exe	SUSP

Image

WIN_DESKTOP_42_20260311.raw

Class

Status

COMPLETE

Finding Counts

Critical1

High2

Medium1

Low1

Status Breakdown

Open3

Escalated1

Resolved1

Escalate this entire case to a Tier 3 Threat Hunter for deep-dive analysis.