bf9582efc7fe8a94841131fee70b54bf156972896053dd9d8e7490c98d2f9413

Analysis

max time kernel
34s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 18:32

Target

bf9582efc7fe8a94841131fee70b54bf156972896053dd9d8e7490c98d2f9413.exe
Size

643KB
MD5

c2babad953903c08c2499b4f70d34e19
SHA1

025448f8fdfc102c0671448800364b3cd403c892
SHA256

bf9582efc7fe8a94841131fee70b54bf156972896053dd9d8e7490c98d2f9413
SHA512

a2ec9511eb69a28c3d8c196b9575637f8280b740290ce82664bd01db7df4d9e3d39c26463280a056dcace347ebb2676d75951c558fbbc86188645902c04ead8e
SSDEEP

12288:EFd0/lHoquYEHnmaUcZ5GSAI4jX4OPk5gXcpjGKTxjF:kdOrSHHUoIBnPk5gsNGKTVF

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3288	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3288	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

C:\Users\Admin\AppData\Local\Temp\bf9582efc7fe8a94841131fee70b54bf156972896053dd9d8e7490c98d2f9413.exe
"C:\Users\Admin\AppData\Local\Temp\bf9582efc7fe8a94841131fee70b54bf156972896053dd9d8e7490c98d2f9413.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4572

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x294 0x304
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3288