e305600e0e2c4c147cebaa2ab9fe15f594a8804e98e855c8d48e4f0fec74f5f9

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 14:58

Target
cbb54135e08123a0bd0b80cea9ee884a.exe
Size 39KB
Sample240315-scmx9sdd64
SHA256 e305600e0e2c4c147cebaa2ab9fe15f594a8804e98e855c8d48e4f0fec74f5f9
MD5 cbb54135e08123a0bd0b80cea9ee884a
SHA1 415e30d1569d0db002f44b0d2ac43a2a5deea45b
SHA512 37f62b17d16c93ef3ff5b4c3ce502c112a591c845ceb71659d88eb9a8c6000811b1ddc3d8c2be5958ba612f3176cb317b170057ac31bc19d7782c35266d64f3c
SSDEEP 768:eZnB5y3cX2hmnNSVKmgbJZB+Z03hTXV97JknbcuyD7UEy7V+HrtN:sc3cTnN/mAJZB+ZwhTXrJknouy8EiaN
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2784	cbb54135e08123a0bd0b80cea9ee884a.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2148	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2148	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\cbb54135e08123a0bd0b80cea9ee884a.exe
"C:\Users\Admin\AppData\Local\Temp\cbb54135e08123a0bd0b80cea9ee884a.exe"
1⤵
- Loads dropped DLL
PID:2784

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8 0x518
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2148

bassmod.dll

Path C:\Users\Admin\AppData\Local\Temp\bassmod.dll
Size 9KB
SHA256 844eb66a10b848d3a71a8c63c35f0a01550a46d2ff8503e2ca8947978b03b4d2
MD5 780d14604d49e3c634200c523def8351
SHA1 e208ef6f421d2260070a9222f1f918f1de0a8eeb
SHA512 a49c030f11da8f0cdc4205c86bec00653ec2f8899983cad9d7195fd23255439291aaec5a7e128e1a103efd93b8566e86f15af89eba4efebf9debce14a7a5564b
SSDEEP 192:Yjtr1Et860Vu6tAo2j+feMnkqtDXuulsa7k0yRlm7/Pdl:AtU8Zu6K+feJCuwsL00la/Pd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2784-0-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/2784-5-0x0000000000400000-0x000000000041C000-memory.dmp

Download