c284480fea318c56c073f5ee03cc124beaacf9abc7d23b09b70b3b19a1f9ab3e

Analysis

max time kernel
73s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2023 13:06

Target

c284480fea318c56c073f5ee03cc124beaacf9abc7d23b09b70b3b19a1f9ab3e.exe
Size

10.0MB
MD5

414bde98857ebcdf85f3efa43a0a1944
SHA1

891ffe02efeb61566994ec92305df204682c71a6
SHA256

c284480fea318c56c073f5ee03cc124beaacf9abc7d23b09b70b3b19a1f9ab3e
SHA512

c0015f49d8329d54fcb8ad8041833d250af0c8050865f2efabf7709dbe350df2381e067636f4f3d39a57961c8be4e89905f944c61f9b3965612b3e8220c07ccb
SSDEEP

196608:3rGnJzgTmX5ad0OIOZ6sSOplVpFL1bmnmIZHoxl/6ZG:izgTmX5aui6sZpfBmmYHoT/oG

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

c284480fea318c56c073f5ee03cc124beaacf9abc7d23b09b70b3b19a1f9ab3e.exe

pid process

1784 c284480fea318c56c073f5ee03cc124beaacf9abc7d23b09b70b3b19a1f9ab3e.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

c284480fea318c56c073f5ee03cc124beaacf9abc7d23b09b70b3b19a1f9ab3e.exe

pid process

1660 c284480fea318c56c073f5ee03cc124beaacf9abc7d23b09b70b3b19a1f9ab3e.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 1816 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 1816 AUDIODG.EXE

pid	process
1784	c284480fea318c56c073f5ee03cc124beaacf9abc7d23b09b70b3b19a1f9ab3e.exe

description	pid	process
Token: 33	1816	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1816	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

c284480fea318c56c073f5ee03cc124beaacf9abc7d23b09b70b3b19a1f9ab3e.exec284480fea318c56c073f5ee03cc124beaacf9abc7d23b09b70b3b19a1f9ab3e.exe

pid	process
1660	c284480fea318c56c073f5ee03cc124beaacf9abc7d23b09b70b3b19a1f9ab3e.exe
1660	c284480fea318c56c073f5ee03cc124beaacf9abc7d23b09b70b3b19a1f9ab3e.exe
1784	c284480fea318c56c073f5ee03cc124beaacf9abc7d23b09b70b3b19a1f9ab3e.exe
1784	c284480fea318c56c073f5ee03cc124beaacf9abc7d23b09b70b3b19a1f9ab3e.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c284480fea318c56c073f5ee03cc124beaacf9abc7d23b09b70b3b19a1f9ab3e.exe

description	pid	process	target process
PID 1660 wrote to memory of 1784	1660	c284480fea318c56c073f5ee03cc124beaacf9abc7d23b09b70b3b19a1f9ab3e.exe	c284480fea318c56c073f5ee03cc124beaacf9abc7d23b09b70b3b19a1f9ab3e.exe
PID 1660 wrote to memory of 1784	1660	c284480fea318c56c073f5ee03cc124beaacf9abc7d23b09b70b3b19a1f9ab3e.exe	c284480fea318c56c073f5ee03cc124beaacf9abc7d23b09b70b3b19a1f9ab3e.exe
PID 1660 wrote to memory of 1784	1660	c284480fea318c56c073f5ee03cc124beaacf9abc7d23b09b70b3b19a1f9ab3e.exe	c284480fea318c56c073f5ee03cc124beaacf9abc7d23b09b70b3b19a1f9ab3e.exe

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x468 0x4a0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1816

C:\Users\Admin\AppData\Local\Temp\c284480fea318c56c073f5ee03cc124beaacf9abc7d23b09b70b3b19a1f9ab3e.exe

Filesize
10.0MB

MD5
fd607ff899fadd703efacace2f04fdc8

SHA1
a34f2f02a1a3a6a39e8dfdf0024cb5fe8a0b5aeb

SHA256
9a368feff4ec3f4e97db62752e60c092e04012ec63ec14a2bed5c09f2487fb23

SHA512
c81da64eccdfb5bfd5ffe4f22507543fce0511956c444e4df9579cc7b6bc610e06310f4687735fb338006c865696f7cd4254cf4ab542e2204bc8c89912126532

Download Submit
memory/1660-4-0x0000000000400000-0x0000000000E50000-memory.dmp

Filesize
10.3MB

Download
memory/1784-3-0x0000000075500000-0x00000000755F0000-memory.dmp

Filesize
960KB

Download
memory/1784-5-0x0000000075500000-0x00000000755F0000-memory.dmp

Filesize
960KB

Download