e563b78309c4e1fa7458e4373278c3b8c76693d2fd0dbb4f88edcf977a591a2b | Triage

Analysis

max time kernel
146s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4d4ccfc403848cb4b3cd53394b272580.exe
Size

396KB
MD5

4d4ccfc403848cb4b3cd53394b272580
SHA1

314b49a2938ede82df95011827537daf7f28eeb0
SHA256

e563b78309c4e1fa7458e4373278c3b8c76693d2fd0dbb4f88edcf977a591a2b
SHA512

ddbfdd6dadbf1359a7a9e47b77621301bcffa836d33b78a0df1d8a69800cd4a402ff2b07a1343261d0c74da17fd876306e1b6df1ad0a9917c6811c4de2f17e45
SSDEEP

6144:qi22uJpPt/pzECWtN6TIDRIh/nLH1aEMW:qi22uJpPtYk

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1272	4d4ccfc403848cb4b3cd53394b272580.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2112	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2112	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\4d4ccfc403848cb4b3cd53394b272580.exe
"C:\Users\Admin\AppData\Local\Temp\4d4ccfc403848cb4b3cd53394b272580.exe"
1⤵
- Loads dropped DLL
PID:1272

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x150 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download