dc1f4cfd064c60ac539523c4154729bf6582f5f0a90e58411155c4ad94a80739

max time kernel
53s
max time network
65s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
27-06-2023 09:31

Sharing

Target

mw_fixer_upd.exe
Size

1.4MB
MD5

b71ceec4d2fa2b92317a2cf5b6da57d2
SHA1

13ffc0de36ced78ac6265a2218eaab9febd2ec37
SHA256

dc1f4cfd064c60ac539523c4154729bf6582f5f0a90e58411155c4ad94a80739
SHA512

3ad188dd6596b35053607c0eeeb0fa780475c633ada516ac043c39cd3d381f482abc1af72732aa199a673a9fa3ef446cad190e37aea8511e65e450200d7f2aaf
SSDEEP

24576:H+HmINIU4dInPT2LgQgkzBdsRfOndZEEbZjH+B1LJ:H+GaIU4dSaL/Jz3n3DeBF

Score

1^/10

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1168	mw_fixer_upd.exe
Token: 33	1732	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1732	AUDIODG.EXE
Token: 33	1732	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1732	AUDIODG.EXE
Token: SeDebugPrivilege	1564	mw_fixer_upd.exe

C:\Users\Admin\AppData\Local\Temp\mw_fixer_upd.exe
"C:\Users\Admin\AppData\Local\Temp\mw_fixer_upd.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1168

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x544
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Users\Admin\AppData\Local\Temp\mw_fixer_upd.exe
"C:\Users\Admin\AppData\Local\Temp\mw_fixer_upd.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1564

C:\Users\Admin\AppData\Local\Temp\mw_fixer_upd.exe
"C:\Users\Admin\AppData\Local\Temp\mw_fixer_upd.exe"
1⤵
PID:1960

memory/1168-54-0x00000000013E0000-0x000000000154A000-memory.dmp

Filesize
1.4MB

Download
memory/1168-55-0x0000000000130000-0x0000000000136000-memory.dmp

Filesize
24KB

Download
memory/1168-56-0x000000001B140000-0x000000001B1C0000-memory.dmp

Filesize
512KB

Download
memory/1168-57-0x00000000001D0000-0x00000000001DE000-memory.dmp

Filesize
56KB

Download
memory/1564-58-0x00000000003D0000-0x000000000053A000-memory.dmp

Filesize
1.4MB

Download
memory/1564-59-0x0000000000630000-0x00000000006B0000-memory.dmp

Filesize
512KB

Download