da79e0317881f0600ddaddf593184b1e7d6eb54604de089e4d625741e21c004b

Analysis

max time kernel
47s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 04:53

Target

trichloromethane-safety.exe
Size

83KB
MD5

1453f56916c0ea96b9ba5b49f09757e2
SHA1

3e25edc13b69e5db4769f061f586e42b812996bf
SHA256

da79e0317881f0600ddaddf593184b1e7d6eb54604de089e4d625741e21c004b
SHA512

37febf9c7bd3f35b45de356e8dc92a9bd5e065471669cb9afdb7048308df0c852b3cbfc5f2a3cab2887d67c9dab4f2fb2bb21ee9de42d13b700784367d1f8ca6
SSDEEP

1536:X5RkE0HODVj5XVgyi31RRzuo3tpwOcr2zS5KTV8yYJcsWrcd6/MAedu:X590HODVViFRRz3dpxe2zSwTXoj6/Mz0

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2012	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2012	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\trichloromethane-safety.exe
"C:\Users\Admin\AppData\Local\Temp\trichloromethane-safety.exe"
1⤵
PID:936

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498 0x2b4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2012