ab1b686507c51b418c710e90e0e8ecc7b31447e8ee9718dcd2f46a5885d5377c

Analysis

max time kernel
20s
max time network
24s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 17:11

Target

OSDPReset.zip
Size

3.2MB
MD5

62612b939043e81ce64bf69f19f32bfb
SHA1

88d8d73dc5d70d2c5299a33958d013597fcfac55
SHA256

7460f438ba0b798d6f5ad31619f30d3682986becc8d6a87659d6e44cdc150020
SHA512

fb0ff0eee7b32a5c28ef5e99303b9bec4e5fd8381c55731c13e18b2df095b952e957bbbb2917705fc7036fcd6dcbc6c4b3eb5b8f1409b4e6e59c58700a08b65d
SSDEEP

49152:tVDHKE5MRoIkTXHIHvZFFAkyZQaDS4odgLR3aAuvrDRLcp90Cwu5Zm2utW3Pxd:tYpq6R/AHZyMR3or5c0CC7t8Pn

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2052	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2052	AUDIODG.EXE
Token: 33	2052	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2052	AUDIODG.EXE

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\OSDPReset.zip
1⤵
PID:2548

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x468
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2052