e3ff60c46ddaa2c1ee1329f5771e6bc2be909f208cad5652bb7292e3dfc7aacd

Analysis

max time kernel
10s
max time network
22s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 14:35

Reason

Machine shutdown

Target

end.exe
Size

13KB
MD5

d7e7d01d076296bf09447f21e7855d72
SHA1

bf562205971b4f22df50852e2765125e27914320
SHA256

e3ff60c46ddaa2c1ee1329f5771e6bc2be909f208cad5652bb7292e3dfc7aacd
SHA512

9709c011eac7e50bb564762a830526f41ae24db910ac80d90612e7a7aacee0a7d072cf7b6423661a6cafcab950289fa846685b0dbe015dfa4af2dc27a66cbe12
SSDEEP

384:5bO6uCAN7o3B61imERh68PJUe6ltK29HqX:ROL6EJEqKu0

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3732	end.exe
Token: SeDebugPrivilege	3732	end.exe
Token: 33	5024	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5024	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\end.exe
"C:\Users\Admin\AppData\Local\Temp\end.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3732

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x504 0x4f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5024

memory/3732-0-0x00007FFA7FD33000-0x00007FFA7FD35000-memory.dmp

Filesize
8KB

Download
memory/3732-1-0x0000000000700000-0x000000000070A000-memory.dmp

Filesize
40KB

Download
memory/3732-2-0x00007FFA7FD30000-0x00007FFA807F1000-memory.dmp

Filesize
10.8MB

Download
memory/3732-3-0x00007FFA7FD33000-0x00007FFA7FD35000-memory.dmp

Filesize
8KB

Download
memory/3732-4-0x00007FFA7FD30000-0x00007FFA807F1000-memory.dmp

Filesize
10.8MB

Download