1d28b3fb0f466dd5de505bcc8e05679b1f6a162570a4f77f6012ef080ab0cb2f

Analysis

max time kernel
61s
max time network
68s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2023, 05:38

Target

1d28b3fb0f466dd5de505bcc8e05679b1f6a162570a4f77f6012ef080ab0cb2f.exe
Size

280KB
MD5

62847b18bc6912ed79dc2f65e563bf53
SHA1

b7c90a4be20d71ca3e9023c9fb9d30d3b58781fb
SHA256

1d28b3fb0f466dd5de505bcc8e05679b1f6a162570a4f77f6012ef080ab0cb2f
SHA512

bf06b3a0ae849cfc9510a0a63f180763530ac292a75ffff4e774c3173e075e2a48aac1ff07a2c262013070af0a662cc0c226be7d9798e07fdeea7ff4b8bc9b5f
SSDEEP

6144:6hTCoZcE0/of2MEHIHcY3wcwEXJmLOom+YdIiMd5D5/ZfI:EFd0/lHogEX8LOo7M8Q

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3756	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3756	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5060	1d28b3fb0f466dd5de505bcc8e05679b1f6a162570a4f77f6012ef080ab0cb2f.exe
5060	1d28b3fb0f466dd5de505bcc8e05679b1f6a162570a4f77f6012ef080ab0cb2f.exe
5060	1d28b3fb0f466dd5de505bcc8e05679b1f6a162570a4f77f6012ef080ab0cb2f.exe

C:\Users\Admin\AppData\Local\Temp\1d28b3fb0f466dd5de505bcc8e05679b1f6a162570a4f77f6012ef080ab0cb2f.exe
"C:\Users\Admin\AppData\Local\Temp\1d28b3fb0f466dd5de505bcc8e05679b1f6a162570a4f77f6012ef080ab0cb2f.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5060

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x40c 0x404
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3756