0cf9eb298683ec897c9b912bb17e26fab24f1dd8dea85e0f6555fe0e688bf5b6

Analysis

max time kernel
42s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/02/2023, 19:23

Target

0cf9eb298683ec897c9b912bb17e26fab24f1dd8dea85e0f6555fe0e688bf5b6.exe
Size

1.2MB
MD5

5ab932e9d3b76c9ceef068dc07ce1e04
SHA1

5f60b6a8d57d41d5b97fc61272754fdc989eab45
SHA256

0cf9eb298683ec897c9b912bb17e26fab24f1dd8dea85e0f6555fe0e688bf5b6
SHA512

6d37ea1395edf94a520c7996c42236e374b8ad50deebe7e9fd5c16798d25213ad534a9436da686d57e2bf6d186f0a876eb8ec6a93035c94f12c71dcde641c690
SSDEEP

24576:pFST3lVaDyQmWSZxIBLMX9qKpAw/bdbWZdRbCOJ0u5MbE+z16:p8T1VGyQNS8U9cYbF8XqNzM

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1972	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1972	AUDIODG.EXE
Token: 33	1972	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1972	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1800	0cf9eb298683ec897c9b912bb17e26fab24f1dd8dea85e0f6555fe0e688bf5b6.exe
1800	0cf9eb298683ec897c9b912bb17e26fab24f1dd8dea85e0f6555fe0e688bf5b6.exe
1800	0cf9eb298683ec897c9b912bb17e26fab24f1dd8dea85e0f6555fe0e688bf5b6.exe

C:\Users\Admin\AppData\Local\Temp\0cf9eb298683ec897c9b912bb17e26fab24f1dd8dea85e0f6555fe0e688bf5b6.exe
"C:\Users\Admin\AppData\Local\Temp\0cf9eb298683ec897c9b912bb17e26fab24f1dd8dea85e0f6555fe0e688bf5b6.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1800

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x56c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1972

memory/1800-54-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download
memory/1800-55-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download