5ba5e1d9f743d2f6535b5078442d6388c02d62d19b4b4476ba1c15692cdf1b7d

Analysis

max time kernel
26s
max time network
40s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 00:45

Reason

Machine shutdown

Target

multiferamenta.exe
Size

23KB
MD5

c1e9279f5c91ed859d346a6c3ad50f33
SHA1

c5ac23228e9b98536c122773a87cdd2a07ee6951
SHA256

06729f54add3fc094faec139dfd4e66d015e9c94c6a542f7d4a9af6c5af1fb56
SHA512

e9c288d2dfa827d6f2614e116bd2f454ac6e8fc94ae7c8c00042094a84c4ba2b36a8de9b2990f707fc3483a907b7f3c9881fa3736ccb6fbff8f9fa89b608fe4c
SSDEEP

384:4ccF3qcNybF7OgazPe4RNmJnRks7uznhQ9ZTLYDtg1MhZnAOB2qDgBcuja6xfTmn:DSRNjzPPRNakVzh6ZHXi3J2K6o

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2720	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2720	AUDIODG.EXE
Token: 33	2720	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2720	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\multiferamenta.exe
"C:\Users\Admin\AppData\Local\Temp\multiferamenta.exe"
1⤵
PID:2260

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2720

memory/2956-0-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download