21a1a68f20fdae0e6d07bb37bfb1b1706b489d04adbd6008b3bc5f0a71fbab9a

Analysis

max time kernel
91s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/02/2023, 18:26

Target

21a1a68f20fdae0e6d07bb37bfb1b1706b489d04adbd6008b3bc5f0a71fbab9a.exe
Size

404KB
MD5

1237ebf20b5eef2d2bc354c052a2ad8f
SHA1

130c273062507de5f1ac6c2018da1ca31f0c6448
SHA256

21a1a68f20fdae0e6d07bb37bfb1b1706b489d04adbd6008b3bc5f0a71fbab9a
SHA512

eb52911fd2daa430b97a85be8d1fad733f04df3ebc518f824f805754dcec71e04e6b4d8f880c34be52e5e7fd8d0a2b5cd49533c4af6a27b93cee93385a72772f
SSDEEP

6144:/vaP5eBVWmEb5L4yTiu/SPD0l1+5w+oxCvH+mm3F1HH:3aPGVWmEbNhiu/g0l1+o4vxapH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1832	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1832	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\21a1a68f20fdae0e6d07bb37bfb1b1706b489d04adbd6008b3bc5f0a71fbab9a.exe
"C:\Users\Admin\AppData\Local\Temp\21a1a68f20fdae0e6d07bb37bfb1b1706b489d04adbd6008b3bc5f0a71fbab9a.exe"
1⤵
PID:2952

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x454 0x444
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1832