655a8c2bed8e2d85b24525aa426e5d647f15ddfa156967d64f144c497e8c9665

Analysis

max time kernel
140s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10-06-2023 08:47

Target

05177599.exe
Size

228KB
MD5

038bf1f54a35164fedb79e2319e1bc49
SHA1

e92cdbb5bab92ea3f2d6b0f8f40a5b5df199c6a9
SHA256

655a8c2bed8e2d85b24525aa426e5d647f15ddfa156967d64f144c497e8c9665
SHA512

5928082b8fef2a491eb84ed4ba01c8428cd96425c8c2d433dc6ef80d9c0d4866bb9c20871c6d1268824e435f42526e4e1eb468fe451f0ef02710edb35c08f1c6
SSDEEP

6144:8P5InwynnbJsiufkKWLuvHnLvBbbiXughM:5bEkKeuvHpi+

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1036	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1036	AUDIODG.EXE
Token: 33	1036	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1036	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\05177599.exe
"C:\Users\Admin\AppData\Local\Temp\05177599.exe"
1⤵
PID:1724

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x574
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1036

memory/1724-54-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1724-55-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/1724-61-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/1724-67-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/1724-68-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download