1cb725e1a84952fb74cf2af29550ffc432d9d79f44a32921931da0351c33bf2f

Analysis

max time kernel
140s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2024 08:32

Target

7f5f3c4e2c559502ebcf3c0ae3f59f76.exe
Size

44KB
MD5

7f5f3c4e2c559502ebcf3c0ae3f59f76
SHA1

db21311ed140d22abcb12c41ca387325e2279b4c
SHA256

1cb725e1a84952fb74cf2af29550ffc432d9d79f44a32921931da0351c33bf2f
SHA512

0842732edd317263fb1e9b91aa216ddb549b947456ae33db7930946a962ee8696bd3d0390a2baaa068b417fbc63e7b785c88dc18e3bcb5829571b7a6122f6ee8
SSDEEP

768:EBF1Ch/6mTnCZuNTcJ4rl0yj1vc2NAMdiYbe2V7UNHYB10K+9BQy1gQ+zfKsQELS:6ChSmeZP+A2ugT6E10K+PQy1gQXgxx0

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	840	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	840	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\7f5f3c4e2c559502ebcf3c0ae3f59f76.exe
"C:\Users\Admin\AppData\Local\Temp\7f5f3c4e2c559502ebcf3c0ae3f59f76.exe"
1⤵
PID:3600

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3c8 0x4cc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:840