eac848fc70d618ea9fc6d1734d5c3debbd32ea51cfd25fa9f17c00cc6ef45c63

Analysis

max time kernel
134s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 22:11

Target

14cc38d8323a66031b70cca19bd3db7b.exe
Size

152KB
MD5

14cc38d8323a66031b70cca19bd3db7b
SHA1

8fca29132db4cf91629c7ada17de0603f10d9666
SHA256

eac848fc70d618ea9fc6d1734d5c3debbd32ea51cfd25fa9f17c00cc6ef45c63
SHA512

3064e4e2c364f7a4ccf4a3d99404eacfea4c14bc1a91a9e6b30d1b7b0de77a33e5d647f412639768e6a6cb37f796e82d493d6c43e446fdd27ad658c67610b62a
SSDEEP

3072:PtDG22II8qSpVhhxJ/N98Epk+JECWtN6TIDRIh/nLH1aEMW2ZTP:Fi22uJpPt/pzECWtN6TIDRIh/nLH1aEM

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1736	14cc38d8323a66031b70cca19bd3db7b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2652	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2652	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\14cc38d8323a66031b70cca19bd3db7b.exe
"C:\Users\Admin\AppData\Local\Temp\14cc38d8323a66031b70cca19bd3db7b.exe"
1⤵
- Loads dropped DLL
PID:1736

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x510 0x518
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2652

C:\Users\Admin\AppData\Local\Temp\bassmod.dll

Filesize
9KB

MD5
780d14604d49e3c634200c523def8351

SHA1
e208ef6f421d2260070a9222f1f918f1de0a8eeb

SHA256
844eb66a10b848d3a71a8c63c35f0a01550a46d2ff8503e2ca8947978b03b4d2

SHA512
a49c030f11da8f0cdc4205c86bec00653ec2f8899983cad9d7195fd23255439291aaec5a7e128e1a103efd93b8566e86f15af89eba4efebf9debce14a7a5564b

Download Submit
memory/1736-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download