54f96a6a2aecea449548505db12b35ad86b97f462b99a8a0609b0ad30bf965d8

Analysis

max time kernel
141s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 06:35

Target

Pointstone.System.Cleaner.v5.9.1.321.WinALL.Cracked-BRD/Crack/Patch.exe
Size

47KB
MD5

200bd3e2ad1a62b7d674ceb0cdafc56e
SHA1

af1950c02c85027999fdb03c18c67ddfa6b74dfe
SHA256

ad7e9a091c8bdd553d40e106602712d52bf829e93f5026c7010714ca5d46c583
SHA512

9488b7ba2f0f9fbd419fc9131b9672e665598a9c73facf80b1d092fffdab3d19df4f09481a076a4a1b4b3963e905a1419d2d4e4f3e2f451ae9079beff333545f
SSDEEP

768:pawIPifkExpHg2jCW8btTOoCq4yfJSAgVFzcND1/157KHk90bgYlBJXaAEEV+2Gl:paRifkEbAOrsuOD5NV9+gGJAE3GnXOk

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
3192	Patch.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4348	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4348	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\Pointstone.System.Cleaner.v5.9.1.321.WinALL.Cracked-BRD\Crack\Patch.exe
"C:\Users\Admin\AppData\Local\Temp\Pointstone.System.Cleaner.v5.9.1.321.WinALL.Cracked-BRD\Crack\Patch.exe"
1⤵
- Loads dropped DLL
PID:3192

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x49c 0x460
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4348

C:\Users\Admin\AppData\Local\Temp\bassmod.dll

Filesize
9KB

MD5
780d14604d49e3c634200c523def8351

SHA1
e208ef6f421d2260070a9222f1f918f1de0a8eeb

SHA256
844eb66a10b848d3a71a8c63c35f0a01550a46d2ff8503e2ca8947978b03b4d2

SHA512
a49c030f11da8f0cdc4205c86bec00653ec2f8899983cad9d7195fd23255439291aaec5a7e128e1a103efd93b8566e86f15af89eba4efebf9debce14a7a5564b

Download Submit
memory/3192-0-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3192-5-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download