0a69d190eaac444ac573c2e0bc73b04a541eb15b702aa43e080f44356b8b3da2

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 22:58

Target
Client.exe
Size 6.6MB
Sample261016-2x3nwssvbz
SHA256 0a69d190eaac444ac573c2e0bc73b04a541eb15b702aa43e080f44356b8b3da2
MD5 7a65eb623973363f1e0ae8815cc0c056
SHA1 fc8839550426664b6168cad6a14c31c1df9166b7
SHA512 59ada1f9d250dc0443390ba0da1fd07a247ffb7bdc16fff43af21446d67f9da363cc48866a746a3ee7f2a6839648f525d98c45d4e92c62ff96211e9a781da981
SSDEEP 49152:uWXppBv+xF0zvsGP34FJP4y3VkT8+HE3uxuMvAKrTZrNyA+2dWhT8p5QGnin3e3s:RoGsjVMxdAGTZ3bG3e3hyzqTb
TLSH
T1A4667123EC01AC135A7922303DD55605F1203B8FA6C55C9BBEBC745E4FB49B298BA71B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4832	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4832	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
PID:4900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3800

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004D4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4832