032a632213680a6292d26840bf63972094b209dc7807571f6e13f9e2de0be74a

Analysis

user interaction
yes
max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 13:51

Target
dw.exe
Size 156KB
Sample260809-q6be8ayflf
SHA256 032a632213680a6292d26840bf63972094b209dc7807571f6e13f9e2de0be74a
MD5 3a56fa952c6cc4b1856ce9e6a73b3c4b
SHA1 e9885949c23efee94ec085237ffb1a28b12b7f3d
SHA512 1d6d6bc4e4974d335e61145b18ef93d2adf9071a8eaeb8a3b06ea03112861298dacff83802a07d4fcb5fb0bee7bca09bf9d1124e48e103e90c8693a3bc376002
SSDEEP 3072:9MdkOUreuLMW1YuscQOd7rSv2EVvqx4OawKgHwoDvX:9cklrBLMxuD7rSv2ErwjH5v
TLSH
T112F36C47B2A520FDE177923588921A06F77678360750ABEF43A0477A1F237D1AD3BB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5900	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5900	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\dw.exe
"C:\Users\Admin\AppData\Local\Temp\dw.exe"
1⤵
PID:4300

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004D8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5900