eaca067b5ecf9d123ee31badd86eefbc650d420b22db878d1492cbd31eb9fe61

Analysis

user interaction
yes
max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 05:37

Target
KEVLAR.exe
Size 27.4MB
Sample260822-ga7dcaec52
SHA256 eaca067b5ecf9d123ee31badd86eefbc650d420b22db878d1492cbd31eb9fe61
MD5 241525f223c45803abd11a5a6926524a
SHA1 5cd681908ff53595f98c7d9e5574c48d8d6cd4fa
SHA512 648311979425d9a7308573e6d1c2ede538e927c8d91c2e1fa3ac31ed84988140e1e286ec991a52e8d514062fb7bd559c85252e1e70c9ce04279194e978c209ed
SSDEEP 196608:fwh6KWq3cWTicRpwOLZGdf73bVQo95sQ55hQ2Lbr/lavfzv3CE/DPUANwetWyOSd:fwbU7LVQo9GQ55hzLSdNwJpu
TLSH
T13A57B653E37705E2E4BEC1399562A627BDB230A48339A7DF9B4066075B217F0EE39341
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1528	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1528	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\KEVLAR.exe
"C:\Users\Admin\AppData\Local\Temp\KEVLAR.exe"
1⤵
PID:3276

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004D4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1528

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:572