9b9b49e92d44bc46b7de867d92c07490cf029497b24638a6e336cc8c71124182

Analysis

max time kernel
28s
max time network
30s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 14:04

Target
sex.exe
Size 1014KB
Sample260418-rdb2qabs61
SHA256 9b9b49e92d44bc46b7de867d92c07490cf029497b24638a6e336cc8c71124182
MD5 f86d6376086ab9fb40fe3ccd00125cd0
SHA1 48c235ada49551cf806d4ac442977ef087bcee53
SHA512 9fa4d82c74932cfbb4995af8bf22d3e3ef9e3a658b044186f82574a9500fa08abb23b7fe93b8e2bb99469c8e783fd8640eecf5407623b5db7daad0df14dd1b8a
SSDEEP 24576:vVQOnPHL3Cy4BJh/tnfBo60OegX7AofEOtMHBjXm7:9frCyEhVnn0ErvfkBj
TLSH
T14425BF09B3E505D9E633957C8892A223DA327C0907B862DB73C745B96FAF6D05D37B02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5400	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5400	AUDIODG.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 5368	2720	sex.exe	81

C:\Users\Admin\AppData\Local\Temp\sex.exe
"C:\Users\Admin\AppData\Local\Temp\sex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5368

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004C8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5400

memory/2720-3-0x00000204DC570000-0x00000204DC57C000-memory.dmp

Download

memory/2720-4-0x00000204DDE30000-0x00000204DDE42000-memory.dmp

Download