6832fe4f967ca6a6b3b9daa89db1209f6dc54970ac6290cd8a3baa757a51f31f

Analysis

max time kernel
146s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 20:18

Target

106646c4abbb0f3c78ea14340c251211.exe
Size

446KB
MD5

106646c4abbb0f3c78ea14340c251211
SHA1

d4282f04bb6502b58dd6df5b8b96935a7cb426db
SHA256

6832fe4f967ca6a6b3b9daa89db1209f6dc54970ac6290cd8a3baa757a51f31f
SHA512

d750c795c837e8e3edd19626ed61119915c0ec2f3a8cbec37b03d30f378c88bd4c58394eeea4f637693347762e04d18d8ba3b7ec01e800a56aba00c5e90cd915
SSDEEP

6144:dpmNnyfNfzjyjFzPYInelhrs2QYj5CQfCGxudYGJBIJQv:yoNfz4PrelDQu5jAaM

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
3532	106646c4abbb0f3c78ea14340c251211.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3108	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3108	AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x508 0x50c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3108

C:\Users\Admin\AppData\Local\Temp\106646c4abbb0f3c78ea14340c251211.exe
"C:\Users\Admin\AppData\Local\Temp\106646c4abbb0f3c78ea14340c251211.exe"
1⤵
- Loads dropped DLL
PID:3532

memory/3532-1-0x00000000001D0000-0x00000000001D3000-memory.dmp

Filesize
12KB

Download
memory/3532-0-0x0000000000400000-0x000000000055C000-memory.dmp

Filesize
1.4MB

Download
memory/3532-6-0x0000000000400000-0x000000000055C000-memory.dmp

Filesize
1.4MB

Download
memory/3532-8-0x00000000001D0000-0x00000000001D3000-memory.dmp

Filesize
12KB

Download