35ff7ac5964c28252fa1f62e44c1757025b12ac5e1ff4f378dd3c825afde0f4b

Analysis

max time kernel
121s
max time network
132s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
10/03/2025, 11:24

Target

Release_1807/Expediente de pruebas de infracción de propiedad intelectual.jpg
Size

186.0MB
MD5

f0d5d35fd26c65e42f4af8b610e2a051
SHA1

c62969ec1dff803b9a76b50ae8565fbaa6713508
SHA256

0b8533914e417a5c0ce2b58affa1a1923c0426d3ab2aa6cbf16a344d1172e7bd
SHA512

762ed2a403395d3fed28f6e26599c70e7295a79c7cd92ec06650ffcf4f71f43034fe26f68ebda48459d1c00722438e4d015fb51974e5f3e878cb3cd23623ccdb
SSDEEP

3145728:lP5we+ubm/Z/QpQWQPkIhmuMm9ul4u395zv0pm7+GEovGtmmIYuOJI3vzvIosQ:lP2etm/ZNkI0PmAl4uN7i4mmm2OJEjIm

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2520	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2520	AUDIODG.EXE
Token: 33	2520	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2520	AUDIODG.EXE

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen "C:\Users\Admin\AppData\Local\Temp\Release_1807\Expediente de pruebas de infracción de propiedad intelectual.jpg"
1⤵
PID:2096

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x474
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2520