2498c70cd7f20a6cfc45b6e7c65d4ab7e339042b9531185e8af7a1c15f72f43f

Analysis

max time kernel
138s
max time network
141s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 14:43

Target

2498c70cd7f20a6cfc45b6e7c65d4ab7e339042b9531185e8af7a1c15f72f43f.exe
Size

28KB
MD5

ed5d6d5ef76526699e5e9d7c501616ec
SHA1

5ac597a176d87ed72906cb8acffe43c8cd10dbf0
SHA256

2498c70cd7f20a6cfc45b6e7c65d4ab7e339042b9531185e8af7a1c15f72f43f
SHA512

f856e42720c32607cfc66d91ddb7f65acc76adda8f630869ef1e46f36655d0ae52ecb83d04ec90061492119eff294083dffa7e916ada5b0182ca5cf8fd0aa886
SSDEEP

768:l9GbIaxnvvvvvvvvvvvvvvvvvvvvvvvvvvCVFO2UNEb0Vs5MzBbWZiiJz305RqLB:PG82nvvvvvvvvvvvvvvvvvvvvvvvvvv6

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	560	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	560	AUDIODG.EXE
Token: 33	560	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	560	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\2498c70cd7f20a6cfc45b6e7c65d4ab7e339042b9531185e8af7a1c15f72f43f.exe
"C:\Users\Admin\AppData\Local\Temp\2498c70cd7f20a6cfc45b6e7c65d4ab7e339042b9531185e8af7a1c15f72f43f.exe"
1⤵
PID:780

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x304
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:560

memory/780-54-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download
memory/780-55-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/780-56-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download