98dbadc1742577599993d27c15d012fdd3dc13b78e71d935c4a573b95436fb94 | Triage

Analysis

max time kernel
141s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 15:13

Sharing

Report Analysis Logs

General

Target

Fully Stopped.exe
Size

635KB
MD5

6b3d71f1d6e9338e732c312b37cb5773
SHA1

9d8cbf3f58472b1e065830b4eec3dd530a256508
SHA256

ca14a59812c41857fe983dfd2131688793fc12fabdd3df7242a1e7b566bcd1ff
SHA512

6c5058896df12cebe393c5d6a598e5cbc7a82a5f1b191cba400acaaedd66ae6e49d3a1571210e2ee35ad5a3d96eec859c7e8075b475f84339f883fe9ec332483
SSDEEP

6144:eAexxfADG6t1CPssz0f1Kc9qGcNfSH/pe4QtvQQHVrAsg36NVq:eAtDG6t1sGcNdlA6C

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4948	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4948	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2016	Fully Stopped.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2644	2016	Fully Stopped.exe	86
PID 2016 wrote to memory of 2644	2016	Fully Stopped.exe	86

C:\Users\Admin\AppData\Local\Temp\Fully Stopped.exe
"C:\Users\Admin\AppData\Local\Temp\Fully Stopped.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe
  "C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe" --attach 2016 1995480633344
  2⤵
  PID:2644

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2ec 0x2f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-1-0x000001D09D7B0000-0x000001D09D7C0000-memory.dmp

Filesize
64KB

Download
memory/2016-0-0x000001D0BD8D0000-0x000001D0BD8E0000-memory.dmp

Filesize
64KB

Download
memory/2016-3-0x000001D09D7B0000-0x000001D09D7C0000-memory.dmp

Filesize
64KB

Download
memory/2016-2-0x000001D0BD8D0000-0x000001D0BD8E0000-memory.dmp

Filesize
64KB

Download