ba181400a18de2b81729ca3c30e046ad3d7dba1bf11f52935dc5ee9715364dd7

Analysis

max time kernel
139s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 19:46

Target

NEAS.1ba4846d6ea913c15249e15c2ef6d9c0.exe
Size

2.4MB
MD5

1ba4846d6ea913c15249e15c2ef6d9c0
SHA1

8175c0381421cb2198a6fcfa30db00b379561f74
SHA256

ba181400a18de2b81729ca3c30e046ad3d7dba1bf11f52935dc5ee9715364dd7
SHA512

97b01e387ded4248464e04166066c5427383a3d99689425f8c47c599b8b26c3db8291fc89400c9fbc1ebf26a461c293d65c8f12230dead5d1419df50c49d5192
SSDEEP

49152:+diempuR6yE5gWESSn5iXW8XzfY67TjxoeqyTHHVmbDoPOtbhXGuj:am06TgWESU5imi067T9oeq6H1ZObh9

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2000	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2000	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

C:\Users\Admin\AppData\Local\Temp\NEAS.1ba4846d6ea913c15249e15c2ef6d9c0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.1ba4846d6ea913c15249e15c2ef6d9c0.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4040

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4c4 0x418
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2000

memory/4040-0-0x0000000000400000-0x0000000000678000-memory.dmp

Filesize
2.5MB

Download
memory/4040-1-0x0000000000400000-0x0000000000678000-memory.dmp

Filesize
2.5MB

Download