b81310e2ec0de6df68ed9b8fa65624ad6b2b46d0c9caf4df23648774f9f8a69d

Analysis

max time kernel
85s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2023, 10:54

Target

b81310e2ec0de6df68ed9b8fa65624ad6b2b46d0c9caf4df23648774f9f8a69d.exe
Size

1.0MB
MD5

bad3923e183b362ce66cb6b59ee294c5
SHA1

8ecd25586b8a78969d8ff9b6a3bdae3decd2bb6d
SHA256

b81310e2ec0de6df68ed9b8fa65624ad6b2b46d0c9caf4df23648774f9f8a69d
SHA512

f15e4370c5534766c1b9127d4f0db747b5755e777dd185047f7ad32a48a69a0f325c96994c4c69b583376052ee5ac5a10e8156ccba5f9696e75c051b1289ed26
SSDEEP

24576:e6MCvFqF80yOWniKKe2n3zdZeRHLWFeYpAeclrLlgd:Bv9i8YW7cU2mgd

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3660	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3660	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\b81310e2ec0de6df68ed9b8fa65624ad6b2b46d0c9caf4df23648774f9f8a69d.exe
"C:\Users\Admin\AppData\Local\Temp\b81310e2ec0de6df68ed9b8fa65624ad6b2b46d0c9caf4df23648774f9f8a69d.exe"
1⤵
PID:2656

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x4a0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3660

memory/2656-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2656-1-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download