46a35ced614c105412aa9b3db9bb8d6cc6262c6e258c5ae544b4c45448853f38

Analysis

max time kernel
142s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 08:19

Target
Papers Please v1.4.11.124/PapersPlease.exe
Size 638KB
Sample240223-j71ceadf8t
SHA256 9451692a33540d96352c290e1fb5fdade29b2b112206ccd40d711e271d2886b7
MD5 fdc53add928ce28442ef5ad77d24c9cb
SHA1 97bf3314fcfb0495e5e3c098e1b53db33b763825
SHA512 ce9098994b93000edeb75880c96102b27522f400f5941d114dce20c2e379728319b0bf8db05e15a207480debcb7a70f7371c2c97dae8d07b91d9ebf63421f1bf
SSDEEP 6144:npC62lkCT6tk3uZbnZpxqzCldNDnF77Ev1H:n4eC2pxqz6dNJ77Ev1H
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	468	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	468	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1144	PapersPlease.exe
3752	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 872	1144	PapersPlease.exe	88
PID 1144 wrote to memory of 872	1144	PapersPlease.exe	88

C:\Users\Admin\AppData\Local\Temp\Papers Please v1.4.11.124\PapersPlease.exe
"C:\Users\Admin\AppData\Local\Temp\Papers Please v1.4.11.124\PapersPlease.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Users\Admin\AppData\Local\Temp\Papers Please v1.4.11.124\UnityCrashHandler64.exe
  "C:\Users\Admin\AppData\Local\Temp\Papers Please v1.4.11.124\UnityCrashHandler64.exe" --attach 1144 1760354373632
  2⤵
  PID:872

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500 0x490
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:468

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:3680

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3752