3e45ce4d022ef0b2727db605c5559609f56cc8eb899b4ef64955806098999b80

Analysis

max time kernel
151s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 04:07

Target

0de84f8e5ceb10f8c15170cf2128b1dc.exe
Size

220KB
MD5

0de84f8e5ceb10f8c15170cf2128b1dc
SHA1

027f0ec272d81db0b7330ddc217ee06feb97c3a1
SHA256

3e45ce4d022ef0b2727db605c5559609f56cc8eb899b4ef64955806098999b80
SHA512

93c4a2d1b0157d8a0aac67b73e85078fb028e7f1155c5405e41be9ca948a0b9f4641120ef241bfb65ca0c15182ae2960ef17091222b8e88a1c36f4ec58312372
SSDEEP

1536:TXo3QCi18tQpnJXgEXnWISinp+UcMX2R67M6bqWH67+kvE9O5SUMkp0LEbEEE58g:jo3Ri18epN+U9X2J3jUTeyj

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
3464	0de84f8e5ceb10f8c15170cf2128b1dc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1948	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1948	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\0de84f8e5ceb10f8c15170cf2128b1dc.exe
"C:\Users\Admin\AppData\Local\Temp\0de84f8e5ceb10f8c15170cf2128b1dc.exe"
1⤵
- Loads dropped DLL
PID:3464

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3c4 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1948

C:\Users\Admin\AppData\Local\Temp\bassmod.dll

Filesize
9KB

MD5
780d14604d49e3c634200c523def8351

SHA1
e208ef6f421d2260070a9222f1f918f1de0a8eeb

SHA256
844eb66a10b848d3a71a8c63c35f0a01550a46d2ff8503e2ca8947978b03b4d2

SHA512
a49c030f11da8f0cdc4205c86bec00653ec2f8899983cad9d7195fd23255439291aaec5a7e128e1a103efd93b8566e86f15af89eba4efebf9debce14a7a5564b

Download Submit
memory/3464-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download