a3f87c63250416c75cfc0a82c40d5814f671cd0ddbc2634e71792f9c279af477

Analysis

max time kernel
149s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 10:17

Target
0b02.exe
Size 19KB
Sample260523-mbkhvsav7x
SHA256 a3f87c63250416c75cfc0a82c40d5814f671cd0ddbc2634e71792f9c279af477
MD5 72ff5da0ee6b1ee2d84348f06686ed3d
SHA1 2cf197f23bb61e19cb620d489e34bd61a95d759b
SHA512 98ee925c50ec7b2c27a4bca5150db976fb20688754669f0366de0030d86ae42be37d24e8e5cd19a27a3d5afdb33c7aaf5ce77ec0245d189d97e782ec52a80ba9
SSDEEP 192:GdLd4sMjd4tZzmVFQnGy/BZS2Bubi/aVJgfJmbfWJ55tfCD/:GZ24nuKnGAjSi1fJu
TLSH
T12C922A05B3E8499EEA3B733889F2691DE3B1391217319ACF0351855B5F726C0983DB2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3348	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3348	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\0b02.exe
"C:\Users\Admin\AppData\Local\Temp\0b02.exe"
1⤵
PID:2468

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004B8 0x00000000000004B0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3348