569af6723e41444a91fd5a17355204d42963d309b25dbe57e59c0bdd7a11c7b8

Analysis

max time kernel
34s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03/03/2023, 13:50

Target

MDE_File_Sample_46e61f1223e9d32122dd447e9b20cbc3ad208517.zip
Size

1.1MB
MD5

b36df8dfd7fdb1292624ed9e4acf91db
SHA1

7b748d499f3d0f589538106afcae74703c6453e2
SHA256

569af6723e41444a91fd5a17355204d42963d309b25dbe57e59c0bdd7a11c7b8
SHA512

46cacbb58236d80dfcac774801ed527d94d6dcb45c8caaf5e2f70fc4f7dd5076a42a0df66cbac1ea240560da14555f9543aa1472796cbbedf97efd6a1ef38aa0
SSDEEP

24576:tm7knKGD2HBwnAsSLEw32GpzYmcKKwQSeG9Ksa7IMwU+:Ei0unAscZ5YXlSFzA0

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1488	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1488	AUDIODG.EXE
Token: 33	1488	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1488	AUDIODG.EXE

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\MDE_File_Sample_46e61f1223e9d32122dd447e9b20cbc3ad208517.zip
1⤵
PID:1972

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0xc8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1488