decf97328f90ad3a5d14853159b3e01b7f847a2c01f025545e5eed8a0327ef7b

Analysis

max time kernel
90s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2022, 22:06

Target
decf97328f90ad3a5d14853159b3e01b7f847a2c01f025545e5eed8a0327ef7b.exe
Size 1.3MB
Sample221031-11aa3sedfj
SHA256 decf97328f90ad3a5d14853159b3e01b7f847a2c01f025545e5eed8a0327ef7b
MD5 c62d9205946f3e34766b619346801889
SHA1 c5505fdcaec7d6241881452f31b8a16ce3203bef
SHA512 4656893b95f660e718cb4f8c03e4efc261c9188e54c4d4dee9e9770cf2d11787148f009acff15a2c73b51819bd7ea1eedb1561585265bfd96e9fb9a9d9248ae7
SSDEEP 24576:kdOhBgDMN++uUViQAih7qtWa5sMjbNvzyFDkmN224BY/0jdYdt:kd2d++uwAw7WiMX1mNt4Xedt
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1460	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1460	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4948	decf97328f90ad3a5d14853159b3e01b7f847a2c01f025545e5eed8a0327ef7b.exe
4948	decf97328f90ad3a5d14853159b3e01b7f847a2c01f025545e5eed8a0327ef7b.exe
4948	decf97328f90ad3a5d14853159b3e01b7f847a2c01f025545e5eed8a0327ef7b.exe

C:\Users\Admin\AppData\Local\Temp\decf97328f90ad3a5d14853159b3e01b7f847a2c01f025545e5eed8a0327ef7b.exe
"C:\Users\Admin\AppData\Local\Temp\decf97328f90ad3a5d14853159b3e01b7f847a2c01f025545e5eed8a0327ef7b.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4948

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x404 0x498
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1460