f600439150630e7ad60ff0eb8e47c0f51b526c1d9207b82504fdf399a0a8a022

Analysis

max time kernel
151s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 12:38

Target

f600439150630e7ad60ff0eb8e47c0f51b526c1d9207b82504fdf399a0a8a022.exe
Size

506KB
MD5

4708b89cf24c7859f5d1a1588b1dbe83
SHA1

f7c54e673ca057c9c80fba1687e47f610e00df44
SHA256

f600439150630e7ad60ff0eb8e47c0f51b526c1d9207b82504fdf399a0a8a022
SHA512

3ca876cf0a9fa542b1d0b1bf7b52cd03f6a6d78ddb994524883f6a373b1de5d3a2ba7fc486386e2a9bcd86241dbbcb52d911d91423018a2c18e2b08f3e3ba370
SSDEEP

6144:WnzUncbQat/YLvRki9KoK55rbpMrgRg9nanIqF5y:szMcbQaaVkidK5xbjgkIy

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4452	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4452	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\f600439150630e7ad60ff0eb8e47c0f51b526c1d9207b82504fdf399a0a8a022.exe
"C:\Users\Admin\AppData\Local\Temp\f600439150630e7ad60ff0eb8e47c0f51b526c1d9207b82504fdf399a0a8a022.exe"
1⤵
PID:3412

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x49c 0x498
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4452