f650f6b70609cae10a3d54081284200342ed37155dbd2ed3c132e414153042f9

Analysis

max time kernel
127s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 23:35

Target

f650f6b70609cae10a3d54081284200342ed37155dbd2ed3c132e414153042f9.exe
Size

270KB
MD5

5636874132a61f00eedd2534f1dd5840
SHA1

b37e30b62ccf2575a88e28e602ae7b284c83e0b1
SHA256

f650f6b70609cae10a3d54081284200342ed37155dbd2ed3c132e414153042f9
SHA512

3b22710832eeabbb54c97d0a97b17b7451ec437eafa63a2e6fa55bb5d7fa41565736c1300033171fb6f6e3f4a18b60e17ce43eb1491398b1afb53e6f441718c4
SSDEEP

6144:C3BL2uJpPt/p+/rburmwoFwoeU7UVUtO65DT5AdwB+NKwEocVIm0Soc4BD5ZD:8BL2uJpPtyioVYSoc4B/

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
5080	f650f6b70609cae10a3d54081284200342ed37155dbd2ed3c132e414153042f9.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3136	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3136	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\f650f6b70609cae10a3d54081284200342ed37155dbd2ed3c132e414153042f9.exe
"C:\Users\Admin\AppData\Local\Temp\f650f6b70609cae10a3d54081284200342ed37155dbd2ed3c132e414153042f9.exe"
1⤵
- Loads dropped DLL
PID:5080

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x514 0x4b8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3136

C:\Users\Admin\AppData\Local\Temp\bassmod.dll

Filesize
9KB

MD5
780d14604d49e3c634200c523def8351

SHA1
e208ef6f421d2260070a9222f1f918f1de0a8eeb

SHA256
844eb66a10b848d3a71a8c63c35f0a01550a46d2ff8503e2ca8947978b03b4d2

SHA512
a49c030f11da8f0cdc4205c86bec00653ec2f8899983cad9d7195fd23255439291aaec5a7e128e1a103efd93b8566e86f15af89eba4efebf9debce14a7a5564b

Download Submit
memory/5080-132-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/5080-134-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download