61e834f3a7f6eec9b76b483a3548463ecc6fd35f0f5eb52c3b0441c05f093336

Analysis

max time kernel
106s
max time network
85s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08-05-2023 00:39

Target

cslol-manager-windows.exe
Size

20.7MB
MD5

a76c2abec3b7b10f801b92e6862b8c93
SHA1

d984cf495720deca0412ecdcc5bc2c59355af1cd
SHA256

61e834f3a7f6eec9b76b483a3548463ecc6fd35f0f5eb52c3b0441c05f093336
SHA512

465cb8107abab822b449291555046ce5407bd06bde970b1a8d6aec3361b888577ac868e31388937d65a0d780d1c5d12c0d38f70e1783ad25aa774a044a7ec199
SSDEEP

393216:NN8ldFUrfMsj7rLTSK7kuLhlE5efyUojaC4cy87jaXtt1KfZGZGbV+KST:/8lzUwkrfLhiefca7cypxKxG4Z+T

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1592	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1592	AUDIODG.EXE
Token: 33	1592	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1592	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1724	cslol-manager-windows.exe

C:\Users\Admin\AppData\Local\Temp\cslol-manager-windows.exe
"C:\Users\Admin\AppData\Local\Temp\cslol-manager-windows.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1724

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x584
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1592