677f6752ead771226f50a115a471f1fc2e92829feee624e392b500bcd5ae6f27

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-01-2023 07:12

Target

677f6752ead771226f50a115a471f1fc2e92829feee624e392b500bcd5ae6f27.exe
Size

5.3MB
MD5

aec10254f199917d5dfc22e2667bae3e
SHA1

39949843d6d50816d2d5f4b7905bbe5592295289
SHA256

677f6752ead771226f50a115a471f1fc2e92829feee624e392b500bcd5ae6f27
SHA512

0ea8bf0b3da60b344c92c4e235f631a028191eec44770b8a8fcfda93eb80e276ebab7dd44423438cc2ca5248f846b34e9134ab59a99761d12b7725cdef4985c6
SSDEEP

98304:sts056W4Mz6C8NNWj2YI1KFgMsU653t7CfC9:656cP86jApMsU65d2fy

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1048	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1048	AUDIODG.EXE
Token: 33	1048	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1048	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1036	677f6752ead771226f50a115a471f1fc2e92829feee624e392b500bcd5ae6f27.exe
1036	677f6752ead771226f50a115a471f1fc2e92829feee624e392b500bcd5ae6f27.exe

C:\Users\Admin\AppData\Local\Temp\677f6752ead771226f50a115a471f1fc2e92829feee624e392b500bcd5ae6f27.exe
"C:\Users\Admin\AppData\Local\Temp\677f6752ead771226f50a115a471f1fc2e92829feee624e392b500bcd5ae6f27.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1036

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x52c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1048

memory/1036-54-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download