fcc4269b870509817ba96e580d679407a60c0a8b8fde1614eab0cdc5d3514c07

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 13:29

Target

fcc4269b870509817ba96e580d679407a60c0a8b8fde1614eab0cdc5d3514c07.exe
Size

66KB
MD5

09d05aa4e6c4cd04d575384578f60dfc
SHA1

62fd7179abc673d984d74762636c4e9fc34f428a
SHA256

fcc4269b870509817ba96e580d679407a60c0a8b8fde1614eab0cdc5d3514c07
SHA512

2b6e8bb13da029f767a13f65872f966bee3f32b16d469556039ce9cbc94d8adcebf994f86f549ed46f30725e33666aada358c5160b5b710f42d7edfc38df12cb
SSDEEP

1536:0qc/66OlECDFwwsrSD3ViBv7GkamfzVu9Z1FpDWfBrM:0b/9OlECDywc0l+vJ+7W5

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/812-54-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral1/memory/812-55-0x0000000000400000-0x0000000000431000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	908	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	908	AUDIODG.EXE
Token: 33	908	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	908	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\fcc4269b870509817ba96e580d679407a60c0a8b8fde1614eab0cdc5d3514c07.exe
"C:\Users\Admin\AppData\Local\Temp\fcc4269b870509817ba96e580d679407a60c0a8b8fde1614eab0cdc5d3514c07.exe"
1⤵
PID:812

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x52c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:908

memory/812-54-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/812-55-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download