e66438c7e06a32ba8ed59b169b0baa1ff89bd89b864b7aace9970709d2cd9e9f

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 02:40

Target

8b2f75983bc7abc83ee9302d44cb64dc.exe
Size

113KB
MD5

8b2f75983bc7abc83ee9302d44cb64dc
SHA1

f1c834e0a270abd7c7c954824bdedfb678d77ee7
SHA256

e66438c7e06a32ba8ed59b169b0baa1ff89bd89b864b7aace9970709d2cd9e9f
SHA512

35be26cf2185f2a490909f48f0960b211e4a97ab215b27a0901a0f5aaa15679d787b21fc37a179228216aadee3de2d4e3ccabc04c3192e1a0f315766a3a3276b
SSDEEP

1536:a+t/ly5o4rTlh2b2+O6O2NapIO8SinUdsutNey6cg6L3kEC2eXWsFQJ3LIWjsPqd:a+TyVvTq8DSnZgk/u1MWjsNI

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	728	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	728	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\8b2f75983bc7abc83ee9302d44cb64dc.exe
"C:\Users\Admin\AppData\Local\Temp\8b2f75983bc7abc83ee9302d44cb64dc.exe"
1⤵
PID:4160

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x514 0x150
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:728

memory/4160-0-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4160-1-0x00000000021F0000-0x00000000021F2000-memory.dmp

Filesize
8KB

Download
memory/4160-2-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4160-3-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4160-4-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4160-5-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4160-6-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4160-7-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4160-8-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4160-9-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4160-10-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4160-11-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4160-12-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4160-13-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4160-14-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4160-15-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download