f262dc19a658b6b6520e4290a85bd4eb8cd6f03498dff97bd8b675b5262aad93

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 21:42

Target

f262dc19a658b6b6520e4290a85bd4eb8cd6f03498dff97bd8b675b5262aad93.exe
Size

188KB
MD5

f46e7febf7176ade44e4e9486159ef42
SHA1

2f917292382b96ae450ce4788fba46db4c511b6a
SHA256

f262dc19a658b6b6520e4290a85bd4eb8cd6f03498dff97bd8b675b5262aad93
SHA512

abfcb8d29fa5bf6e77cba527ec5690ff3d7e9f3733af1967daa09d66c5b6f559b9e5aae7ad52ed8482ac13f98166f784aaf81953785b487b35c80a6a1d4fc4bc
SSDEEP

3072:Lh/XdEk9mcH35GbLmTjkFcILyAl5j+ojI:Lh/tEk9DHIby3kFcILNG

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1704	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1704	AUDIODG.EXE
Token: 33	1704	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1704	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\f262dc19a658b6b6520e4290a85bd4eb8cd6f03498dff97bd8b675b5262aad93.exe
"C:\Users\Admin\AppData\Local\Temp\f262dc19a658b6b6520e4290a85bd4eb8cd6f03498dff97bd8b675b5262aad93.exe"
1⤵
PID:1352

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1704