cfc80dc06bdeb6a46f870667cb40ccf7827a6c3479cf15c5018ee2e5026bcfd7

Analysis

max time kernel
60s
max time network
62s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 10:02

Target

cfc80dc06bdeb6a46f870667cb40ccf7827a6c3479cf15c5018ee2e5026bcfd7.exe
Size

56KB
MD5

d5e7a6f89558d29e7fc49beaa9899f18
SHA1

7651aecd16dfceb358710d981f66d486f5b7e6b8
SHA256

cfc80dc06bdeb6a46f870667cb40ccf7827a6c3479cf15c5018ee2e5026bcfd7
SHA512

8a34c7a238120987d0b2b0b81afebc49cf5be202311d5f9c2cbc898678e639f1cf86f7ae00418a176aab730632237df36534a23e5bb228224507ddd8f41b0229
SSDEEP

768:dmMM+nvXehj51Bk1wYfTrz2VZhbw14qF0iGB9gPj6T2nBg:sMMmvXeh2JTrz2a2biU9gPj6Tcg

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1612	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1612	AUDIODG.EXE
Token: 33	1612	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1612	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
992	cfc80dc06bdeb6a46f870667cb40ccf7827a6c3479cf15c5018ee2e5026bcfd7.exe
992	cfc80dc06bdeb6a46f870667cb40ccf7827a6c3479cf15c5018ee2e5026bcfd7.exe

C:\Users\Admin\AppData\Local\Temp\cfc80dc06bdeb6a46f870667cb40ccf7827a6c3479cf15c5018ee2e5026bcfd7.exe
"C:\Users\Admin\AppData\Local\Temp\cfc80dc06bdeb6a46f870667cb40ccf7827a6c3479cf15c5018ee2e5026bcfd7.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:992

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1ac
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1612