5de27e922b1ff2ca06e0454129506afa847864214e2a0e73b9453fffbf93f752

Analysis

max time kernel
149s
max time network
165s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 19:52

Target
1.2.8.2505.06/All Stars.exe
Size 638KB
Sample260724-yllpfsdh59
SHA256 5de27e922b1ff2ca06e0454129506afa847864214e2a0e73b9453fffbf93f752
MD5 e67891a822aabccd3a64b08406e9e52c
SHA1 d2b05cfbbf820faa1309bad5941ece0c7a971f24
SHA512 01c840cf02c1c6539bacd4292a7d2361e8fe79455d4801d27dd19925314e4a14861e9fe02c809ffdcaf65e2f3db3a433e04674d26776bb7fca6b6a9c095bcaf1
SSDEEP 6144:bEbaWnBUCGhEI+ZaXYToH5O4WKjzE8wdTLYj10u8IFRiL73m:boCCijYToHg/qE8qTLSuuKu
TLSH
T15ED4BB51081E61D3E1F891345219D8FEB9325F905AEE1D446EABFEE3B5B39CB9028C13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{544656F6-82F8-4318-8DC0-D24417E20BBD}	All Stars.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2368	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2368	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4836	All Stars.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 1360	4836	All Stars.exe	88

C:\Users\Admin\AppData\Local\Temp\1.2.8.2505.06\All Stars.exe
"C:\Users\Admin\AppData\Local\Temp\1.2.8.2505.06\All Stars.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Users\Admin\AppData\Local\Temp\1.2.8.2505.06\UnityCrashHandler64.exe
  "C:\Users\Admin\AppData\Local\Temp\1.2.8.2505.06\UnityCrashHandler64.exe" --attach 4836 2679200026624
  2⤵
  PID:1360

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004CC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2368