1718075e1fb1dee71b062c21a0cb460c837d527d3ded9e893a6ebb74dec0464f

Analysis

max time kernel
142s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2023, 18:38

Target

1718075e1fb1dee71b062c21a0cb460c837d527d3ded9e893a6ebb74dec0464f.exe
Size

537KB
MD5

d290f94d5a5a75f6c975905c9c2e18d1
SHA1

aec548a6b609acb6cde4549b5e583d167bad9850
SHA256

1718075e1fb1dee71b062c21a0cb460c837d527d3ded9e893a6ebb74dec0464f
SHA512

6b9590693cb96c36c8dd7f5fb6d44f4eee56d5f4df49b3a1847c394fdaaa2af9ee973b83e8216e683eca448bec4cb16d51f28a1fe37bb9400177df0e456d36e3
SSDEEP

12288:AFd0/hHwJYEHMgvqfAq2uSWOS08XAnVZKp7hW4BsPtR:odO0/LqL9SWGFnV8hPAtR

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4844	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4844	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3936	1718075e1fb1dee71b062c21a0cb460c837d527d3ded9e893a6ebb74dec0464f.exe
3936	1718075e1fb1dee71b062c21a0cb460c837d527d3ded9e893a6ebb74dec0464f.exe
3936	1718075e1fb1dee71b062c21a0cb460c837d527d3ded9e893a6ebb74dec0464f.exe

C:\Users\Admin\AppData\Local\Temp\1718075e1fb1dee71b062c21a0cb460c837d527d3ded9e893a6ebb74dec0464f.exe
"C:\Users\Admin\AppData\Local\Temp\1718075e1fb1dee71b062c21a0cb460c837d527d3ded9e893a6ebb74dec0464f.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3936

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2fc 0x2f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4844