6589008f680328707aaae689a396ee0fbcd180f797228e36cb7019e65ee735ca

Analysis

max time kernel
66s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31/03/2023, 15:02

Target

windows8-rt-kb4012598-x86_a0f1c953a24dd042acc540c59b339f55fb18f594.cab
Size

872KB
MD5

ae3865f6d94f6a88c8ccf9d19b135820
SHA1

a0f1c953a24dd042acc540c59b339f55fb18f594
SHA256

6589008f680328707aaae689a396ee0fbcd180f797228e36cb7019e65ee735ca
SHA512

3ddfb23826c8d1f2f0ceaa7b450d7f2cfacb15f9f18117cdfd8588f88b89e16d70c96c395d9fe5226d934c4a6e62154a58684aa59182ee4e9b745fb1681ce4b4
SSDEEP

24576:bOa6UyIvKN4YNmvsh2+Gy95e0OShJwFzVJ1b:bOtUyMC40I+GCe0TwFp/

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1328	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1328	AUDIODG.EXE
Token: 33	1328	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1328	AUDIODG.EXE

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\windows8-rt-kb4012598-x86_a0f1c953a24dd042acc540c59b339f55fb18f594.cab
1⤵
PID:1364

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0xe0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1328