3679c309062fab650e1c323307fcdf6d07d16ab7d3db247c61b7fd3c0f2b5459

Analysis

max time kernel
121s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18-10-2022 10:20

Target

13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31.exe
Size

2.9MB
MD5

c6901bc6720e1e30c6c2e89aae874a90
SHA1

783b2b053ef0345710cd2487e5184f29116e367c
SHA256

13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31
SHA512

64647585b838fa91c545219350b58609f90fa4817bd8848e4af0b71c98e6d340dc011abe405ce6f044cb5a99acfacdc8bd212ea7289b002ab8285aa42e9008fb
SSDEEP

49152:4dwE1vCCeShiBHJFIPiEPE3bvk6Ca89388YhwjfJNu/RgaJ2wtb:WwE1253IPiYE3bnCa8HzjOvwwtb

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1016	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1016	AUDIODG.EXE
Token: 33	1016	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1016	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31.exe
C:\Users\Admin\AppData\Local\Temp\13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31.exe -a 12345
1⤵
PID:1964

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1016

memory/1964-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/2016-55-0x000007FEFBFE1000-0x000007FEFBFE3000-memory.dmp

Filesize
8KB

Download