6a08e1a3cbb242a71a81cf72f1c8f7a773674f2348186b7d354a41867670ba10

Analysis

max time kernel
144s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 17:46

Target

6a08e1a3cbb242a71a81cf72f1c8f7a773674f2348186b7d354a41867670ba10.exe
Size

62KB
MD5

246a6c9c4a2591d1e99fe4e9a7f30a60
SHA1

845a7c4a89d9913a155d99c2f59fd45366c5ac14
SHA256

6a08e1a3cbb242a71a81cf72f1c8f7a773674f2348186b7d354a41867670ba10
SHA512

2b0af7c0037e82f11523f3f1afa90a16981d5dcb4d40d88c16c00393690b81f889e11281081e065e073f9b3c3b68808c74c933cc39e52139e23c082e3c4d6bd5
SSDEEP

768:Mna5JUgIuzzaFEX4Bp0mIe/bb+oji5o6keJncciyTNzg:Ma5UqzaFEX4BYemSPJeJccRJg

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1380	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1380	AUDIODG.EXE
Token: 33	1380	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1380	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\6a08e1a3cbb242a71a81cf72f1c8f7a773674f2348186b7d354a41867670ba10.exe
"C:\Users\Admin\AppData\Local\Temp\6a08e1a3cbb242a71a81cf72f1c8f7a773674f2348186b7d354a41867670ba10.exe"
1⤵
PID:756

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1380

memory/756-54-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/756-55-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/756-56-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download