9623b6cd48e981f5eb55c321ae235ea8db09515fa6b8eef2f78cbc8e374ab0a3

Analysis

max time kernel
147s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 02:40

Target

4d50309cc7d7aa9333c31376d3bbb969.exe
Size

151KB
MD5

4d50309cc7d7aa9333c31376d3bbb969
SHA1

42b594b427593a6e633b5fa0e0fec6172f6afe88
SHA256

9623b6cd48e981f5eb55c321ae235ea8db09515fa6b8eef2f78cbc8e374ab0a3
SHA512

1894d51e49e51e3d63ad1ad534f3ae7ce9bc846ab2fb4766e7d5292ec3baac58b6469507ed87a2de39b4752086cf369ca054419b9368f4025a60a5c68904e0ed
SSDEEP

1536:FXo3QCi1os0fJbNddI/OwyhNbPZz13tGdQnL0ptQ+:5o3Ri1o9JTdI/OwyhNbPBFE

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
4496	4d50309cc7d7aa9333c31376d3bbb969.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2760	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2760	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\4d50309cc7d7aa9333c31376d3bbb969.exe
"C:\Users\Admin\AppData\Local\Temp\4d50309cc7d7aa9333c31376d3bbb969.exe"
1⤵
- Loads dropped DLL
PID:4496

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x504 0x2ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2760

C:\Users\Admin\AppData\Local\Temp\bassmod.dll

Filesize
9KB

MD5
780d14604d49e3c634200c523def8351

SHA1
e208ef6f421d2260070a9222f1f918f1de0a8eeb

SHA256
844eb66a10b848d3a71a8c63c35f0a01550a46d2ff8503e2ca8947978b03b4d2

SHA512
a49c030f11da8f0cdc4205c86bec00653ec2f8899983cad9d7195fd23255439291aaec5a7e128e1a103efd93b8566e86f15af89eba4efebf9debce14a7a5564b

Download Submit
memory/4496-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download