f329ea2c754ab196d15c20fbf9abd722fa63630631144c5a409bd2a20172196b

Resubmissions

18-09-2022 19:48

18-09-2022 18:14

max time kernel
53s
max time network
60s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18-09-2022 18:14

Target

V7bTrYJ4lbO6OS.dll
Size

159KB
MD5

7932ee5fa6f83b149569752c47e04b87
SHA1

6eb115feadc5808507fb5a666dd18aa89a45616c
SHA256

f329ea2c754ab196d15c20fbf9abd722fa63630631144c5a409bd2a20172196b
SHA512

17ba26e69f7536f5adaa52454fbd407338be61d97bc396baa591de9fa19aab3e539b4ca32059b2ddb1b901ac7ecd341dff9ead706fc0d058086e6b3795642f58
SSDEEP

3072:pusrpo1j49JvKa0ePbh37E6ZO78buZKxrF:ZQcvKpE37E6nmKhF

Score

8^/10

Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exe

flow pid process

1 992 rundll32.exe
2 992 rundll32.exe
4 992 rundll32.exe
6 992 rundll32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1852	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1852	AUDIODG.EXE
Token: 33	1852	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1852	AUDIODG.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 240 wrote to memory of 992	240	rundll32.exe	rundll32.exe
PID 240 wrote to memory of 992	240	rundll32.exe	rundll32.exe
PID 240 wrote to memory of 992	240	rundll32.exe	rundll32.exe
PID 240 wrote to memory of 992	240	rundll32.exe	rundll32.exe
PID 240 wrote to memory of 992	240	rundll32.exe	rundll32.exe
PID 240 wrote to memory of 992	240	rundll32.exe	rundll32.exe
PID 240 wrote to memory of 992	240	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\V7bTrYJ4lbO6OS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:240

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\V7bTrYJ4lbO6OS.dll,#1
2⤵
- Blocklisted process makes network request
PID:992

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4c0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1852

memory/992-54-0x0000000000000000-mapping.dmp

Download
memory/992-55-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/992-56-0x00000000746F0000-0x0000000074722000-memory.dmp

Filesize
200KB

Download
memory/992-58-0x0000000074730000-0x0000000074762000-memory.dmp

Filesize
200KB

Download
memory/992-59-0x00000000746F0000-0x0000000074722000-memory.dmp

Filesize
200KB

Download
memory/992-60-0x0000000074730000-0x0000000074762000-memory.dmp

Filesize
200KB

Download
memory/1260-61-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Filesize
8KB

Download