f329ea2c754ab196d15c20fbf9abd722fa63630631144c5a409bd2a20172196b

Resubmissions

18-09-2022 19:48

18-09-2022 18:14

max time kernel
53s
max time network
60s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18-09-2022 18:14

Target

V7bTrYJ4lbO6OS.dll
Size

159KB
MD5

7932ee5fa6f83b149569752c47e04b87
SHA1

6eb115feadc5808507fb5a666dd18aa89a45616c
SHA256

f329ea2c754ab196d15c20fbf9abd722fa63630631144c5a409bd2a20172196b
SHA512

17ba26e69f7536f5adaa52454fbd407338be61d97bc396baa591de9fa19aab3e539b4ca32059b2ddb1b901ac7ecd341dff9ead706fc0d058086e6b3795642f58
SSDEEP

3072:pusrpo1j49JvKa0ePbh37E6ZO78buZKxrF:ZQcvKpE37E6nmKhF

Score

8^/10

Blocklisted process makes network request 4 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1852	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1852	AUDIODG.EXE
Token: 33	1852	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1852	AUDIODG.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 240 wrote to memory of 992	240	rundll32.exe	28
PID 240 wrote to memory of 992	240	rundll32.exe	28
PID 240 wrote to memory of 992	240	rundll32.exe	28
PID 240 wrote to memory of 992	240	rundll32.exe	28
PID 240 wrote to memory of 992	240	rundll32.exe	28
PID 240 wrote to memory of 992	240	rundll32.exe	28
PID 240 wrote to memory of 992	240	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\V7bTrYJ4lbO6OS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\V7bTrYJ4lbO6OS.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:992

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4c0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1852

memory/992-55-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/992-56-0x00000000746F0000-0x0000000074722000-memory.dmp

Filesize
200KB

Download
memory/992-58-0x0000000074730000-0x0000000074762000-memory.dmp

Filesize
200KB

Download
memory/992-59-0x00000000746F0000-0x0000000074722000-memory.dmp

Filesize
200KB

Download
memory/992-60-0x0000000074730000-0x0000000074762000-memory.dmp

Filesize
200KB

Download
memory/1260-61-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Filesize
8KB

Download