544631320cefad8195a1cea2ebf5d95f3998148854cccc2b80b8c78a650488cf

Analysis

max time kernel
19s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:04

Target

544631320cefad8195a1cea2ebf5d95f3998148854cccc2b80b8c78a650488cf.exe
Size

84KB
MD5

53bf4f027a7e71d70cd9db69d9eed39c
SHA1

6eb544e5b87ba47ace34679bc5376db79d91b876
SHA256

544631320cefad8195a1cea2ebf5d95f3998148854cccc2b80b8c78a650488cf
SHA512

4ce5db9e38332f212f65df7d8d6bc12ba7e46057c18372571517d3aec11d123e67b1230caf2d6c45c753b5fbf04cd2383751acee212ee881f1b9cb564cebc8f1
SSDEEP

1536:VFA8YVtpreIC29Od72S0RRegd3M8dKowiX32diy219WTV1BkmCxONojwiRfo:VF1Ynprez2q4egNmiXibGKVnu46

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1780-54-0x0000000000400000-0x0000000000456000-memory.dmp	upx
behavioral1/memory/1780-55-0x0000000000400000-0x0000000000456000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1244	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1244	AUDIODG.EXE
Token: 33	1244	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1244	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\544631320cefad8195a1cea2ebf5d95f3998148854cccc2b80b8c78a650488cf.exe
"C:\Users\Admin\AppData\Local\Temp\544631320cefad8195a1cea2ebf5d95f3998148854cccc2b80b8c78a650488cf.exe"
1⤵
PID:1780

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x140
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1244

memory/1780-54-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1780-55-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download