Analysis
-
max time kernel
16s -
max time network
24s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09-08-2024 09:14
Behavioral task
behavioral1
Sample
IDA Pro 8.3.230608 (Windows) (x86,x64)/IDA/ida64.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
IDA Pro 8.3.230608 (Windows) (x86,x64)/IDA/ida64.exe
-
Size
4.0MB
-
MD5
23fe02467fb05b85cc78bcaaf1b015da
-
SHA1
79399bce20c07e0845197f4b5ef3d2a2d780ef6a
-
SHA256
c695b8de0b3cb3b152890625ec3e0495bad2cd1b257c89de3169b35e3d67b44c
-
SHA512
cb38da2a0366c73ddcac2a7024d302b80ecb36e5d4dea4a161e468e989e94b8db31cef8326a6a4837a7e3ff59808bd90829311431007aa93b5a521490a1b1c63
-
SSDEEP
49152:3JSx9rKN/uUVPb4QpuLuv9C1nq7IqqvAkuvnb6wPxLIfFvnP9bCxK/kLC/XIB9C:3Qx9asSFClEZlT5a8LaIBAazGXMZ8G
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
ida64.exepid process 3856 ida64.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 4068 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4068 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ida64.exepid process 3856 ida64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IDA Pro 8.3.230608 (Windows) (x86,x64)\IDA\ida64.exe"C:\Users\Admin\AppData\Local\Temp\IDA Pro 8.3.230608 (Windows) (x86,x64)\IDA\ida64.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3856
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x308 0x4581⤵
- Suspicious use of AdjustPrivilegeToken
PID:4068