8cfe620c739729eb82839dffb37a67213b8f4aa2ba480a9dd8fd6b0f02e5d360

Analysis

max time kernel
1486s
max time network
1511s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
22-04-2024 13:42

Target

Fluorocarbomorpholide.harmless.exe
Size

247KB
MD5

bcb5697708f27b938b81b074ba390644
SHA1

5ea57710b17d6d9a28f3cf396e4d9e341a90fba2
SHA256

fc84d511a93e93fd9b0f266249ab85b64c2b32f5163d396a267c08eab07fd8bb
SHA512

85057d8bcd6c36d8e9544ccac77d3bf8ef3ecf7a9b3b6b8d81aa0cd3e6af74ed48a90517815bb3a5b6f8ff8a5bb40c3da71435998fb98576675f9d95b7a889b1
SSDEEP

3072:yWPy+EdP/kDsCnO79mznWSppD1bzjg/rP+PVJ2qPkYFJ12ChYSN8R/2ONglXxfR2:yYEdwTbDDKGtlrl5FBf1wGD4XdJIM

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 2852 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 2852 AUDIODG.EXE

description	pid	process
Token: 33	2852	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2852	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\Fluorocarbomorpholide.harmless.exe
"C:\Users\Admin\AppData\Local\Temp\Fluorocarbomorpholide.harmless.exe"
1⤵
PID:1652

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004B8 0x00000000000004C0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2852