f3045bac4bad6db27d7098b8f4f98cc72ddc70c3a297cc037695f4d2ca6c99a5

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18-01-2024 23:01

Target

66439b8116e8587f73d91184ccfd2e69.exe
Size

52KB
MD5

66439b8116e8587f73d91184ccfd2e69
SHA1

f26f645d8f6ca89c578c7c5f42ae4ede5a7508b0
SHA256

f3045bac4bad6db27d7098b8f4f98cc72ddc70c3a297cc037695f4d2ca6c99a5
SHA512

9e548ff94d90bac70d6396c706680835087e4ecbafff3913de8f8ef7338cbd92324a512daf53c39bae0cacb57f9a90e1f0fbae10f5a6b55370b831f7a7356a7c
SSDEEP

768:lXo3QU1YFEi72unL6rvtLQZ4XGx/5bLuF43UVv7YzS47s4uBuc1m6+yCuwB0o3bF:lXo3QCi1obXG/53uF43rJO12LjF

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
4072	66439b8116e8587f73d91184ccfd2e69.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3752	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3752	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\66439b8116e8587f73d91184ccfd2e69.exe
"C:\Users\Admin\AppData\Local\Temp\66439b8116e8587f73d91184ccfd2e69.exe"
1⤵
- Loads dropped DLL
PID:4072

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f8 0x4fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3752

C:\Users\Admin\AppData\Local\Temp\bassmod.dll

Filesize
9KB

MD5
780d14604d49e3c634200c523def8351

SHA1
e208ef6f421d2260070a9222f1f918f1de0a8eeb

SHA256
844eb66a10b848d3a71a8c63c35f0a01550a46d2ff8503e2ca8947978b03b4d2

SHA512
a49c030f11da8f0cdc4205c86bec00653ec2f8899983cad9d7195fd23255439291aaec5a7e128e1a103efd93b8566e86f15af89eba4efebf9debce14a7a5564b

Download Submit
memory/4072-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download