eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a

Resubmissions

25/04/2023, 18:13

25/04/2023, 16:35

max time kernel
75s
max time network
77s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
25/04/2023, 18:13

Target

eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a.exe
Size

174KB
MD5

3d1c060f9a0bd16fe0275f92a3c151a8
SHA1

b7418df98b087f975c30a3e58315955beb792694
SHA256

eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a
SHA512

2c04a81b5fbc4a3841feb39df866aef1fe44e11841ee84d3883b30c0f40395b6551d22ec5ca529f94659bee43efdc0e45f6f4a81881dc101619dbc9d29434c63
SSDEEP

3072:xgwEVWPt0ViQnTohFBhJ+kNn0B47y8Jsp+d2aNEC6:QVUt0VigypLN4kyR8R

Score

6^/10

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1444	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1444	AUDIODG.EXE
Token: 33	1444	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1444	AUDIODG.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1884	2016	eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a.exe	28
PID 2016 wrote to memory of 1884	2016	eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a.exe	28
PID 2016 wrote to memory of 1884	2016	eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a.exe	28

C:\Users\Admin\AppData\Local\Temp\eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a.exe
"C:\Users\Admin\AppData\Local\Temp\eefa1271d1a2a937d0baa3f0c7d904941151d6c8f915aed4dd51f10fa5d09b2a.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CLS
  2⤵
  PID:1884

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1d0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1444