6da9da79726009d7e63d3e0eb05ea10249c3e3b41efbd3701399e7f7f04853b4

Analysis

max time kernel
262s
max time network
362s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 21:01

Target

6da9da79726009d7e63d3e0eb05ea10249c3e3b41efbd3701399e7f7f04853b4.exe
Size

68KB
MD5

6277b44c942d90c11deafee133fc8083
SHA1

2bc321e4eae2f21159b10fb10474f05f586a926b
SHA256

6da9da79726009d7e63d3e0eb05ea10249c3e3b41efbd3701399e7f7f04853b4
SHA512

a91066270cec0b27ebfae6397ed7fe8478c37b13460207b2d782dcb4032bd1f8390fe172732fecb69420fd8ba75c2a4dbfc6ae049bb5a69a637fa0f8a35fccbf
SSDEEP

768:pSFJhRo+0eBvuDiGXvW1z2FJi0YPzvzZM+DEcGI8AzQwbwSRrRyoQuhJNO+HTAGc:qxr5WfW1Rbvd2I8IbDitKzb

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3040	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3040	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\6da9da79726009d7e63d3e0eb05ea10249c3e3b41efbd3701399e7f7f04853b4.exe
"C:\Users\Admin\AppData\Local\Temp\6da9da79726009d7e63d3e0eb05ea10249c3e3b41efbd3701399e7f7f04853b4.exe"
1⤵
PID:4156

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x310 0x4c0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3040