bd27e611f1efc4eef94baccd5ba95982fedc8b4822c6b15a43b3a3d0773fc076

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 14:16

Target

KeyGen.exe
Size

186KB
MD5

29d2c757af7ba64a25723237fc369bff
SHA1

d572444d3413fa4a21c60953421811d4fbade9bc
SHA256

94d9217e5fd906ef53d647be5ae31a961de5bf4287796f49b89aa209397178da
SHA512

8f3c4cc8df18bc7ad239144c3c7ac12bf20fb88a8dfc9c14e1afcd040f477150644201a27d91ce66000814464caf0e1e8ee91ee3024d20d37e8e1c3a490efa75
SSDEEP

3072:CeNO7WXiJpad7gzeu2oBq+nZvGEzrjonA2PXF+NUBfw3FfJRiNHDTyIlzK2txj8m:Ceog4p6giMBp0EUXfd0QNjTyIl9th

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 4596 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 4596 AUDIODG.EXE

description	pid	process
Token: 33	4596	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4596	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\KeyGen.exe
"C:\Users\Admin\AppData\Local\Temp\KeyGen.exe"
1⤵
PID:3836

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x444 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4596

memory/3836-132-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/3836-133-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download