0a5a638df8a5e9254ec42dd3d8e14668bc36b2ef0ed1ec8a1dd43fa8a5e38704

Resubmissions

14/03/2023, 05:39

14/03/2023, 05:36

max time kernel
146s
max time network
134s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/03/2023, 05:39

Target

wsus.exe
Size

13KB
MD5

cab5fc7334d83e72802bfb4150b77190
SHA1

cad8ec659310a3284e5875ff58f1a33ce9755a0e
SHA256

c2a9988fce8ebc0fddb0335df67f16dce0ed7b0cdfb9219ba7a0eb982beb06ed
SHA512

0ba71d8664443eb306951c69c532e49cae512426e75a320c0954ea328ac01955ddf852abd69fa60c8cbddba3c9eb1d209cca0206d2a5bbbc22f011e564d908f6
SSDEEP

192:kui32jEkL5QgZHwl8j7Mlmiocon/DjO7Rsqeirv0l4ydSaJ0vbE5pz68JoZZLW3H:TE+5VHwa7CFocs/DjZqPcNSaJ0vbrT

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	840	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	840	AUDIODG.EXE
Token: 33	840	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	840	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\wsus.exe
"C:\Users\Admin\AppData\Local\Temp\wsus.exe"
1⤵
PID:2040

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x144
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:840

C:\Users\Admin\AppData\Local\Temp\wsus.exe
"C:\Users\Admin\AppData\Local\Temp\wsus.exe"
1⤵
PID:1760

C:\Users\Admin\AppData\Local\Temp\wsus.exe
"C:\Users\Admin\AppData\Local\Temp\wsus.exe"
1⤵
PID:1588