891846bf656253ca1cdd28584a28681e9604e2a03d74cd6b99313e3bff11daf8

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 00:22

Target

Bloxstrap-v2.7.0.exe
Size

10.1MB
MD5

2c752edef5b0aa0962a3e01c4c82a2fa
SHA1

9c3afd1c63f2b0dbdc2dc487709471222d2cb81e
SHA256

891846bf656253ca1cdd28584a28681e9604e2a03d74cd6b99313e3bff11daf8
SHA512

04d25fe7d40c8c320ffc545a038ad6ea458df6a8a552b0e0393b369a03b9bf273c72f30169bd54e8eb10757c04bdddf3859c601c1eb9e1a12fe4d15658906dfe
SSDEEP

98304:TYd5DQd5Dk9Tsed5DogTrBKvGWD3nIOYoHwfLk3vSmaR0+Mc4AN0edaAHDfysrT4:Tasx3vG6IObAbN0T

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2780	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2780	AUDIODG.EXE
Token: 33	2780	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2780	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.7.0.exe
"C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.7.0.exe"
1⤵
PID:2960

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x5c0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2780