b203de34a65175e91c897976754b8c1ee97e314dfcce0f933b3230cad42d1a74

Analysis

max time kernel
57s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 20:51

Target

b203de34a65175e91c897976754b8c1ee97e314dfcce0f933b3230cad42d1a74.exe
Size

93KB
MD5

fcbc695dd94eb2df04d55dcae58a3478
SHA1

71464cb51a2589319a7265e5e29b057fb31f4bb9
SHA256

b203de34a65175e91c897976754b8c1ee97e314dfcce0f933b3230cad42d1a74
SHA512

719a834a6cc6256f1f1eed35a37dbe7af12bfd5bb4180a148e9e28b12cafd8e9b43bcfdb3ceef0c848de098e17f61c9097243ac14f85f59ec565b2014eebb76a
SSDEEP

1536:ytdHjSTL1nPZQfIV94/XrYa5i0Uf6n3VD96HA0OR7hy+U6A1QI5lnCZzTqwejyYX:ytdOTL1nPZcIc/XrZ5i0l3l92Ary+UVm

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1344	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1344	AUDIODG.EXE
Token: 33	1344	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1344	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\b203de34a65175e91c897976754b8c1ee97e314dfcce0f933b3230cad42d1a74.exe
"C:\Users\Admin\AppData\Local\Temp\b203de34a65175e91c897976754b8c1ee97e314dfcce0f933b3230cad42d1a74.exe"
1⤵
PID:940

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x518
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1344

memory/940-54-0x00000000003E0000-0x000000000042B000-memory.dmp

Filesize
300KB

Download
memory/940-55-0x00000000003E0000-0x000000000042B000-memory.dmp

Filesize
300KB

Download