9ffe2b62ed45181318a49a221eb497f5b55267fb512ce221408990ee6dce3354

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/06/2023, 06:17

Target

pico_park.exe
Size

11.5MB
MD5

52510d499d806b7dc392a17b12bc1ae5
SHA1

76688bea58b8bbe273956183bd7b03af116b7048
SHA256

9ffe2b62ed45181318a49a221eb497f5b55267fb512ce221408990ee6dce3354
SHA512

f2e70125085ba08d9c3c3a91a2ad6147b76947b3fa868babbf8468b6ea4d7c6e17d1a545ca561888f1d162e0c9d4348611013b10e89899e744067efbe7a05b4a
SSDEEP

98304:vkZFrZJWHX4IZCAzxcEz9b7F3kT+c2+KyDS2+KERA1Da7yH3XfEFEBvUIBig6rnO:2JW3BxcEzHo87yHWEB82R67jVWjG6f1

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1936	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1936	AUDIODG.EXE
Token: 33	1936	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1936	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\pico_park.exe
"C:\Users\Admin\AppData\Local\Temp\pico_park.exe"
1⤵
PID:1740

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x270
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1936