e305600e0e2c4c147cebaa2ab9fe15f594a8804e98e855c8d48e4f0fec74f5f9

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 14:58

Target

cbb54135e08123a0bd0b80cea9ee884a.exe
Size

39KB
MD5

cbb54135e08123a0bd0b80cea9ee884a
SHA1

415e30d1569d0db002f44b0d2ac43a2a5deea45b
SHA256

e305600e0e2c4c147cebaa2ab9fe15f594a8804e98e855c8d48e4f0fec74f5f9
SHA512

37f62b17d16c93ef3ff5b4c3ce502c112a591c845ceb71659d88eb9a8c6000811b1ddc3d8c2be5958ba612f3176cb317b170057ac31bc19d7782c35266d64f3c
SSDEEP

768:eZnB5y3cX2hmnNSVKmgbJZB+Z03hTXV97JknbcuyD7UEy7V+HrtN:sc3cTnN/mAJZB+ZwhTXrJknouy8EiaN

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
2784	cbb54135e08123a0bd0b80cea9ee884a.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2148	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2148	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\cbb54135e08123a0bd0b80cea9ee884a.exe
"C:\Users\Admin\AppData\Local\Temp\cbb54135e08123a0bd0b80cea9ee884a.exe"
1⤵
- Loads dropped DLL
PID:2784

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8 0x518
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2148

C:\Users\Admin\AppData\Local\Temp\bassmod.dll

Filesize
9KB

MD5
780d14604d49e3c634200c523def8351

SHA1
e208ef6f421d2260070a9222f1f918f1de0a8eeb

SHA256
844eb66a10b848d3a71a8c63c35f0a01550a46d2ff8503e2ca8947978b03b4d2

SHA512
a49c030f11da8f0cdc4205c86bec00653ec2f8899983cad9d7195fd23255439291aaec5a7e128e1a103efd93b8566e86f15af89eba4efebf9debce14a7a5564b

Download Submit
memory/2784-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2784-5-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download