b4a5baf9a5cb5e7d8a0a71b6d76219ab0c0530a7e9aaa8f4d6996edef78e23d5

Analysis

max time kernel
17s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
20-02-2023 04:49

Target

patch.exe
Size

360KB
MD5

02a70d4df5444fb3b1b18f61100a06e9
SHA1

45b2f5b9b977291458d150298c2a7f96a837dbdb
SHA256

b4a5baf9a5cb5e7d8a0a71b6d76219ab0c0530a7e9aaa8f4d6996edef78e23d5
SHA512

1ab32c0bd930294c2085490a54cc36e920840bfdcbc9b6f2f3f4f0bbe16334e22d9291f345bf6367ae12bfbea7495b424a627c965b8732c4e14cc98362c4418b
SSDEEP

6144:ttqan7x3RHw43HBqAT0e112TiS/eJ4yIVDM0EcUimmY95cD44PL/5NcgNPwGy:LNtBH5BqAT0c8TiSmTIVDM0EcU1/9yDy

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1120	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1120	AUDIODG.EXE
Token: 33	1120	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1120	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\patch.exe
"C:\Users\Admin\AppData\Local\Temp\patch.exe"
1⤵
PID:976

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x588
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1120

memory/976-55-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/976-54-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/976-56-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/976-57-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/976-58-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/976-59-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download