268e4133229d3071e4b55c701c5ab3bea4ebf240c8827fdc790edb6b1b2a268c

Resubmissions

29/05/2026, 22:31

29/05/2026, 22:22

max time kernel
149s
max time network
164s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 22:31

Target
PlantsVsZombiesRH.exe
Size 651KB
Sample260529-2fnteadt4n
SHA256 268e4133229d3071e4b55c701c5ab3bea4ebf240c8827fdc790edb6b1b2a268c
MD5 a2bd3834c56d929704252d458eceb48d
SHA1 cf1842d3a1f51e79814061aec9d46528ce01f835
SHA512 50a98dbdfc1c9da9005bf556c03dced2ff332a9150c62bb6cc13a9092fc4bf1f3a02f4abe77a84578801598d1e44cdf76f3b9f640580eba492903753617a402d
SSDEEP 12288:ZH744aOD8nsmV2eCczU3CAX+dwk7xkKwsBrO:59aOQFwf
TLSH
T17FE495C7B1F1D8C5DE11B938C4E4ADAD8725DEAB9E0F241E08217D9534E913C4AADC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3292	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3292	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1984	PlantsVsZombiesRH.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 576	1984	PlantsVsZombiesRH.exe	79

C:\Users\Admin\AppData\Local\Temp\PlantsVsZombiesRH.exe
"C:\Users\Admin\AppData\Local\Temp\PlantsVsZombiesRH.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe
  "C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe" --attach 1984 1991357566976
  2⤵
  PID:576

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004D0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3292