ceb348dfa61b34bebce021fa783b0afdb874ea7205f75e7fb42b01898439be75

Resubmissions

13-12-2024 17:44

13-12-2024 17:15

13-12-2024 17:14

13-12-2024 17:13

max time kernel
1253s
max time network
1254s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-12-2024 17:13

Reason

Machine shutdown

Target

NanoCore 1.2.2.0_Cracked By Alcatraz3222/ClientPlugin.dll
Size

19KB
MD5

bdc8945f1d799c845408522e372d1dbd
SHA1

874b7c3c97cc5b13b9dd172fec5a54bc1f258005
SHA256

61e9d5c0727665e9ef3f328141397be47c65ed11ab621c644b5bbf1d67138403
SHA512

4fa0ed4ef66e4c442f5fc628e8bfc8a4f84cb213210643996d9387027edb619c054f6104ac889ae77cece09f0304f95d5f20e14d66847e2d382ef51eecec0962
SSDEEP

192:VYLQui6h6p5WW3tZVTnlYJL/eLYLTr2/C8:VYLQu/6/fKqLYLTR

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2004	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2004	AUDIODG.EXE
Token: 33	2004	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2004	AUDIODG.EXE

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NanoCore 1.2.2.0_Cracked By Alcatraz3222\ClientPlugin.dll",#1
1⤵
PID:1792

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1ac
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2004

memory/2288-0-0x0000000002E10000-0x0000000002E11000-memory.dmp

Filesize
4KB

Download
memory/3032-1-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download