9385d7e149bcda79e5a4291ad422c160be8297d029d04ee04c50240fe53aa900

Analysis

Target

9385d7e149bcda79e5a4291ad422c160be8297d029d04ee04c50240fe53aa900.exe
Size

1.9MB
MD5

f901c645188f9c80afa8f49174f065ce
SHA1

272bc9298b394760d68e14dcf479233800a098a9
SHA256

9385d7e149bcda79e5a4291ad422c160be8297d029d04ee04c50240fe53aa900
SHA512

8de72f93ab1a507a08a283da4e8948756364d45fa70e8332da424b27a9cb8d6c3ad93cb5062343a6cc8cf0009d7c7d3fef8e209f99fedbe02b7d2d5c010c291c

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1976	9385d7e149bcda79e5a4291ad422c160be8297d029d04ee04c50240fe53aa900.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1480	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1480	AUDIODG.EXE
Token: 33	1480	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1480	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\9385d7e149bcda79e5a4291ad422c160be8297d029d04ee04c50240fe53aa900.exe
"C:\Users\Admin\AppData\Local\Temp\9385d7e149bcda79e5a4291ad422c160be8297d029d04ee04c50240fe53aa900.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1976

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x554
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1480

memory/1976-54-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download
memory/1976-55-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download
memory/1976-56-0x000007FEEAAE0000-0x000007FEEAAEA000-memory.dmp

Filesize
40KB

Download
memory/1976-57-0x000007FEF6630000-0x000007FEF682F000-memory.dmp

Filesize
2.0MB

Download
memory/1976-58-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download
memory/1976-59-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download
memory/1976-60-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download
memory/1976-61-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download
memory/1976-62-0x0000000000130000-0x000000000013A000-memory.dmp

Filesize
40KB

Download