56b0c6e86f35fbf60c9cd8e3112975e1ff8cb9e6dfa094fcbde2579fc881d3cd

Analysis

max time kernel
0s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 07:36

Target

5ceeec29dfb54a15c9b14137f7936f9e.exe
Size

56KB
MD5

5ceeec29dfb54a15c9b14137f7936f9e
SHA1

200115e7414e423b1995e79c033b2ee9a5100ccf
SHA256

56b0c6e86f35fbf60c9cd8e3112975e1ff8cb9e6dfa094fcbde2579fc881d3cd
SHA512

600f648f6e37ebc1b00dd743b115f33188f00fc47c1dcaf99f459071f454afcb34b54d02ecf00b6b0765001d152bbc221dec742a437548e6001e25fed5043de7
SSDEEP

768:dmMM1nvXehj51Bk1wYfTrz2VZhbw14qF0iGB9gPj6T2nBg:sMMpvXeh2JTrz2a2biU9gPj6Tcg

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2752	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2752	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1220	5ceeec29dfb54a15c9b14137f7936f9e.exe
1220	5ceeec29dfb54a15c9b14137f7936f9e.exe

C:\Users\Admin\AppData\Local\Temp\5ceeec29dfb54a15c9b14137f7936f9e.exe
"C:\Users\Admin\AppData\Local\Temp\5ceeec29dfb54a15c9b14137f7936f9e.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1220

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x424 0x4c4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2752