cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9

Analysis

max time kernel
204s
max time network
220s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 10:03

Target

cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe
Size

393KB
MD5

8cd0df1648102eaf1ae50da01bb4c339
SHA1

58b7db2cef0319d05ae0288fcd3ed59ff8ad40d4
SHA256

cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9
SHA512

0caa9e0be24a8d8446099299cf3bf3f3c0100f62d19727dbc1d453c2ecff8c87a000ac1b9b9fb8661331e80a0ad23a7afda013da74888afe53cad0b34b7d8fbc
SSDEEP

6144:BpdlRQUrbslZwzYdC5tR1bYc0sCLgwZaffdtw2nRfzQpT3+yfrabvpy3gumMlBRR:OV3wzYdcbk2w/sRkxspBoB

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1880-133-0x0000000000400000-0x00000000004D2000-memory.dmp	upx
behavioral2/memory/1880-140-0x0000000000400000-0x00000000004D2000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
4676	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1880 set thread context of 4676	1880	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe	84

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2036	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2036	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4676	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe
4676	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 4676	1880	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe	84
PID 1880 wrote to memory of 4676	1880	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe	84
PID 1880 wrote to memory of 4676	1880	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe	84
PID 1880 wrote to memory of 4676	1880	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe	84
PID 1880 wrote to memory of 4676	1880	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe	84
PID 1880 wrote to memory of 4676	1880	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe	84
PID 1880 wrote to memory of 4676	1880	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe	84
PID 1880 wrote to memory of 4676	1880	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe	84
PID 1880 wrote to memory of 4676	1880	cb2289cc63b402a3cb085b20108e4744932da678c4d32f01c1d5dc386bc529a9.exe	84

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x478 0x470
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Users\Admin\AppData\Local\Temp\bm75CC.tmp

Filesize
33KB

MD5
e4ec57e8508c5c4040383ebe6d367928

SHA1
b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

SHA256
8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

SHA512
77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

Download Submit
memory/1880-141-0x00000000020E0000-0x0000000002122000-memory.dmp

Filesize
264KB

Download
memory/1880-140-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/1880-143-0x0000000002130000-0x0000000002135000-memory.dmp

Filesize
20KB

Download
memory/1880-133-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/4676-138-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4676-137-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4676-136-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4676-135-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4676-142-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4676-134-0x0000000000000000-mapping.dmp

Download
memory/4676-145-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4676-146-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download