e225b24990c421974dbc356a5130d812a63620a442549e33b587a6b3cd4bb20e

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 21:41

Target

136720d89801ebf520f8199d79ccb128.dll
Size

264KB
MD5

136720d89801ebf520f8199d79ccb128
SHA1

e9454ed3763e5052e4eca98daaf68dd85280217b
SHA256

e225b24990c421974dbc356a5130d812a63620a442549e33b587a6b3cd4bb20e
SHA512

7cfd0131bb4f1b93edff4f4b16344c4c7837ef6be9f7739c50e9b07b43bb95890abc3cb7c0ab8cc647b9ecdf812817c45d837df984625d79ffece2c8cd563c7a
SSDEEP

3072:o0dzXkyttLU391eL7DSNh0fcnpdjgz8kboBfYjFzTbmUnAwB/yZHe0FSmGDN2nQN:o6kyrL5DSAfcnHc8QlFnbmU9RzhVn

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1100	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1100	AUDIODG.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 3836	2752	rundll32.exe	87
PID 2752 wrote to memory of 3836	2752	rundll32.exe	87
PID 2752 wrote to memory of 3836	2752	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\136720d89801ebf520f8199d79ccb128.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\136720d89801ebf520f8199d79ccb128.dll,#1
  2⤵
  PID:3836

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x324 0x33c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1100