f8ae777614d3036377852fce0871932b99d60dbc66441bbddb07d62176035fd2 | Triage

Resubmissions

23-10-2021 16:17

211023-trlt7adcgj 3

23-10-2021 16:11

211023-tm4jfadcfp 3

Analysis

max time kernel
300s
max time network
303s
platform
windows7_x64
resource
win7-en-20210920
submitted
23-10-2021 16:17

Sharing

Report Analysis Logs

General

Target

dupeguru-win64.exe
Size

2.2MB
MD5

337ca2fec8b414972f784fe99756a9e9
SHA1

2855ba9b8fa3bee5063f3bb6424542505c66633f
SHA256

15862ed0aa90e271386ac89fb329211651a090548457e89d357fdc594c6e9daf
SHA512

6c26c776e31cad540cc11756eff9fcfbb6187d3648e5f5b3d76e054a4b2ae3d65b503a69e681bf27ffeffafa41962665bfd1a0af2cd2756f90da890c20d071b6

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	396	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	396	AUDIODG.EXE
Token: 33	396	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	396	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\dupeguru-win64.exe
"C:\Users\Admin\AppData\Local\Temp\dupeguru-win64.exe"
1⤵
PID:816

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:556

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:396

C:\Users\Admin\AppData\Local\Temp\dupeguru-win64.exe
"C:\Users\Admin\AppData\Local\Temp\dupeguru-win64.exe"
1⤵
PID:1092

C:\Users\Admin\AppData\Local\Temp\dupeguru-win64.exe
"C:\Users\Admin\AppData\Local\Temp\dupeguru-win64.exe"
1⤵
PID:736

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/556-54-0x000007FEFC351000-0x000007FEFC353000-memory.dmp

Filesize
8KB

Download