52d9642c0148b215088b1fee8da5325a3f0067fa69132e75477e67e702f3d053

Analysis

max time kernel
90s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 19:23

Target

52d9642c0148b215088b1fee8da5325a3f0067fa69132e75477e67e702f3d053.exe
Size

433KB
MD5

81d6608d365553332b24d7010bfa3db5
SHA1

84755b2ac2d7d89d7ae65beb5c1c3fc7af382153
SHA256

52d9642c0148b215088b1fee8da5325a3f0067fa69132e75477e67e702f3d053
SHA512

42af9e30321657b23bc748f1434382cae414ca22ed6f941d5258db9ed35bffa7805abe3814a849154df49544a5a670c2d874eb8dd385a914240a1efe41f5ab56
SSDEEP

6144:JoMO4e/JcVB+dJj+ZU12+r1Q+UmUWcC7VfJVgbJo:gT/JcVB+7+OoAkPC7VfJVgbJo

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1156	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1156	AUDIODG.EXE
Token: 33	1156	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1156	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\52d9642c0148b215088b1fee8da5325a3f0067fa69132e75477e67e702f3d053.exe
"C:\Users\Admin\AppData\Local\Temp\52d9642c0148b215088b1fee8da5325a3f0067fa69132e75477e67e702f3d053.exe"
1⤵
PID:724

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1156