6832fe4f967ca6a6b3b9daa89db1209f6dc54970ac6290cd8a3baa757a51f31f

Analysis

max time kernel
154s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 07:56

Target

106646c4abbb0f3c78ea14340c251211.exe
Size

446KB
MD5

106646c4abbb0f3c78ea14340c251211
SHA1

d4282f04bb6502b58dd6df5b8b96935a7cb426db
SHA256

6832fe4f967ca6a6b3b9daa89db1209f6dc54970ac6290cd8a3baa757a51f31f
SHA512

d750c795c837e8e3edd19626ed61119915c0ec2f3a8cbec37b03d30f378c88bd4c58394eeea4f637693347762e04d18d8ba3b7ec01e800a56aba00c5e90cd915
SSDEEP

6144:dpmNnyfNfzjyjFzPYInelhrs2QYj5CQfCGxudYGJBIJQv:yoNfz4PrelDQu5jAaM

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
4376	106646c4abbb0f3c78ea14340c251211.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4696	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4696	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\106646c4abbb0f3c78ea14340c251211.exe
"C:\Users\Admin\AppData\Local\Temp\106646c4abbb0f3c78ea14340c251211.exe"
1⤵
- Loads dropped DLL
PID:4376

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x420 0x33c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Users\Admin\AppData\Local\Temp\bassmod.dll

Filesize
9KB

MD5
780d14604d49e3c634200c523def8351

SHA1
e208ef6f421d2260070a9222f1f918f1de0a8eeb

SHA256
844eb66a10b848d3a71a8c63c35f0a01550a46d2ff8503e2ca8947978b03b4d2

SHA512
a49c030f11da8f0cdc4205c86bec00653ec2f8899983cad9d7195fd23255439291aaec5a7e128e1a103efd93b8566e86f15af89eba4efebf9debce14a7a5564b

Download Submit
memory/4376-0-0x0000000000400000-0x000000000055C000-memory.dmp

Filesize
1.4MB

Download
memory/4376-1-0x00000000001D0000-0x00000000001D3000-memory.dmp

Filesize
12KB

Download
memory/4376-6-0x0000000000400000-0x000000000055C000-memory.dmp

Filesize
1.4MB

Download
memory/4376-8-0x00000000001D0000-0x00000000001D3000-memory.dmp

Filesize
12KB

Download