cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9

Analysis

max time kernel
57s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 10:03

Target

cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe
Size

393KB
MD5

8cd0df1648102eaf1ae50da01bb4c339
SHA1

58b7db2cef0319d05ae0288fcd3ed59ff8ad40d4
SHA256

cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9
SHA512

0caa9e0be24a8d8446099299cf3bf3f3c0100f62d19727dbc1d453c2ecff8c87a000ac1b9b9fb8661331e80a0ad23a7afda013da74888afe53cad0b34b7d8fbc
SSDEEP

6144:BpdlRQUrbslZwzYdC5tR1bYc0sCLgwZaffdtw2nRfzQpT3+yfrabvpy3gumMlBRR:OV3wzYdcbk2w/sRkxspBoB

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1096-69-0x0000000000400000-0x00000000004D2000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
820	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1096 set thread context of 820	1096	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe	28

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1684	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1684	AUDIODG.EXE
Token: 33	1684	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1684	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
820	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe
820	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 820	1096	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe	28
PID 1096 wrote to memory of 820	1096	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe	28
PID 1096 wrote to memory of 820	1096	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe	28
PID 1096 wrote to memory of 820	1096	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe	28
PID 1096 wrote to memory of 820	1096	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe	28
PID 1096 wrote to memory of 820	1096	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe	28
PID 1096 wrote to memory of 820	1096	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe	28
PID 1096 wrote to memory of 820	1096	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe	28
PID 1096 wrote to memory of 820	1096	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe	28
PID 1096 wrote to memory of 820	1096	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe	28

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1d4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1684

\Users\Admin\AppData\Local\Temp\bmBCCB.tmp

Filesize
33KB

MD5
e4ec57e8508c5c4040383ebe6d367928

SHA1
b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

SHA256
8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

SHA512
77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

Download Submit
memory/820-57-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/820-60-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/820-63-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/820-66-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/820-54-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/820-70-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/820-55-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/820-74-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/820-75-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1096-72-0x0000000000280000-0x0000000000285000-memory.dmp

Filesize
20KB

Download
memory/1096-71-0x0000000000220000-0x0000000000262000-memory.dmp

Filesize
264KB

Download
memory/1096-69-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download