d38afabdc98f8d910dba495fc8eb0868965aa0251a96db190ffba3773704f5b1

Analysis

max time kernel
898s
max time network
475s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 09:37

Target
PlantsVsZombiesRH.exe
Size 651KB
Sample261023-llwhfacf23
SHA256 d38afabdc98f8d910dba495fc8eb0868965aa0251a96db190ffba3773704f5b1
MD5 be26f3109da8ae5bc29d39e7a3405c1c
SHA1 ed7747dd1cf8d4b48af12437d857a17f2100e241
SHA512 30b897c99e4445fdfbc3eeb248468dd0ee628ded8781ce31d37d8cf667672496cf870300468f601fdcf84ef38b2fec23ddcc84856f9b0661357413ad92bb63da
SSDEEP 12288:ZH744aOD8n9G/BwO0HZaVw437Uf+OsYJaHK:59aOgGqHcVwF+KJ/
TLSH
T1BDE491D375D0F4C2DC11BD7B84E4A2EAC7369EAF9E09251B14213DA539A95380EFC839
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1800	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1800	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4376	PlantsVsZombiesRH.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 2620	4376	PlantsVsZombiesRH.exe	90

C:\Users\Admin\AppData\Local\Temp\PlantsVsZombiesRH.exe
"C:\Users\Admin\AppData\Local\Temp\PlantsVsZombiesRH.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe
  "C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe" --attach 4376 2897223553024
  2⤵
  PID:2620

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5636

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2044