439b7a672bd26c81d1fb03e44c477c8e8af1b7465d7aeb18bc865f8e4a1ff4d5

Analysis

max time kernel
3s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 19:02

Target

439b7a672bd26c81d1fb03e44c477c8e8af1b7465d7aeb18bc865f8e4a1ff4d5.exe
Size

2.1MB
MD5

2629779df4cc4d0bc39a66d241fdaf2c
SHA1

811b35f5b84e88588989ae66c1e0ea5faa652992
SHA256

439b7a672bd26c81d1fb03e44c477c8e8af1b7465d7aeb18bc865f8e4a1ff4d5
SHA512

4cd73d6d4dc2d373a5797d20b76c5bf9eb59247f396fc096fad9e6fe3ec28ebb0b3a88b4b7e2ef354a969ece64650b2b944033e99002e63fa412f01ad8725000
SSDEEP

49152:hv428BTQZAR3uHvnPmVrrepMgckSYo9i91ym3ZNJVJkURPa5TDEn:B428VfR+HvuwMGSYJ7ykZVJkoa5TDE

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1740	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1740	AUDIODG.EXE
Token: 33	1740	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1740	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1184	439b7a672bd26c81d1fb03e44c477c8e8af1b7465d7aeb18bc865f8e4a1ff4d5.exe

C:\Users\Admin\AppData\Local\Temp\439b7a672bd26c81d1fb03e44c477c8e8af1b7465d7aeb18bc865f8e4a1ff4d5.exe
"C:\Users\Admin\AppData\Local\Temp\439b7a672bd26c81d1fb03e44c477c8e8af1b7465d7aeb18bc865f8e4a1ff4d5.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1184

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x574
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1740

memory/1184-56-0x00000000767F1000-0x00000000767F3000-memory.dmp

Filesize
8KB

Download