4cc37020c8c53248e9322334549763e12ed7f58dad08b5b924c77f9166ca49fb

Analysis

max time kernel
77s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-02-2023 22:08

Target

Game.exe
Size

57KB
MD5

4cc0a3cb0be1cb00c8feaa88684ec5e0
SHA1

6d562ce66f9a4a9fdd0315afa01388eceac659af
SHA256

b7aa5e1714e0fc539bc1f6bc3ec50a2d393683fb3e943fa72e4d25bf7fd03096
SHA512

fe7355a7b20d99b401fe7bb10adea562a070cda841e23580baeae99a3c537a2c3ad6db03e96e379a89847d062c7d8a37b8d19b736bd3a980a014bf4f53814adf
SSDEEP

768:XnlWv8mkZ4fklKF6+eT3u5LXcFRqzjXmsVmrowxGLvs3TLGlKbFv5M:3lWvkZ+I+4u5LXcs7jVStGLvdo5

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3796 2084 WerFault.exe

pid	pid_target	process	target process
3796	2084	WerFault.exe

Modifies registry class 3 IoCs

Processes:

Game.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	Game.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	Game.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	Game.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Game.exe

pid process

4580 Game.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 2176 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 2176 AUDIODG.EXE
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Game.exe

pid process

4580 Game.exe

pid	process
4580	Game.exe

description	pid	process
Token: 33	2176	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2176	AUDIODG.EXE

pid	process
4580	Game.exe

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2ec 0x500
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2176

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 468 -p 2084 -ip 2084
1⤵
PID:2092

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2084 -s 2464
1⤵
- Program crash
PID:3796

memory/4580-132-0x0000000010000000-0x0000000010324000-memory.dmp

Filesize
3.1MB

Download
memory/4580-133-0x0000000003EC0000-0x0000000003EC4000-memory.dmp

Filesize
16KB

Download
memory/4580-134-0x0000000009B00000-0x0000000009B10000-memory.dmp

Filesize
64KB

Download
memory/4580-135-0x0000000010000000-0x0000000010324000-memory.dmp

Filesize
3.1MB

Download
memory/4580-137-0x0000000000890000-0x00000000008A0000-memory.dmp

Filesize
64KB

Download
memory/4580-136-0x0000000009B00000-0x0000000009B10000-memory.dmp

Filesize
64KB

Download
memory/4580-138-0x0000000010000000-0x0000000010324000-memory.dmp

Filesize
3.1MB

Download