26a30811833fd93ecb266b4e2287e9b30cb99aff38e5109398462946fced4ab0 | Triage

Analysis

max time kernel
40s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22-08-2022 09:21

Sharing

Report Analysis Logs

General

Target

LOCALES/MSAUDDEC.dll
Size

449KB
MD5

76d6aa7eac676315dfc00e17311a3cc5
SHA1

3cd60b77e354a46b9c0e103218edcd2fdb2567ae
SHA256

d245da122919f6b13f16d14ceda814518802864819df21961a5e10771dcae5fa
SHA512

896584c1518fdd25730157b319d2edb90dce5af70cac25f7ccc156df8bbc65120e6e5cf7d9a1c967c9907b59a97c0a017f8d6f6ff5e129334d9270725d1ed362

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2004 wrote to memory of 280	2004	regsvr32.exe	regsvr32.exe
PID 2004 wrote to memory of 280	2004	regsvr32.exe	regsvr32.exe
PID 2004 wrote to memory of 280	2004	regsvr32.exe	regsvr32.exe
PID 2004 wrote to memory of 280	2004	regsvr32.exe	regsvr32.exe
PID 2004 wrote to memory of 280	2004	regsvr32.exe	regsvr32.exe
PID 2004 wrote to memory of 280	2004	regsvr32.exe	regsvr32.exe
PID 2004 wrote to memory of 280	2004	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\LOCALES\MSAUDDEC.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\LOCALES\MSAUDDEC.dll
2⤵
PID:280

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/280-55-0x0000000000000000-mapping.dmp

Download
memory/280-56-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/2004-54-0x000007FEFC1A1000-0x000007FEFC1A3000-memory.dmp

Filesize
8KB

Download