765327e1dc0888c69c92203d90037c5154db9787f54d3fc8f1097830be8c76ab

Analysis

max time kernel
92s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 18:39

Target

765327e1dc0888c69c92203d90037c5154db9787f54d3fc8f1097830be8c76ab.dll
Size

767KB
MD5

0de24cec66ef9d1042be7cf12b87cfc4
SHA1

f7bf7cea89c6205d78fa42d735d81c1e5c183041
SHA256

765327e1dc0888c69c92203d90037c5154db9787f54d3fc8f1097830be8c76ab
SHA512

0eef5ebf2f82cc0c5fe081b6e5bf88d9e6f92d9d8d9a147300f6423cb5626bd58f54547047fc59f63179f402822b8ad9afbd1ade590ff82f00081c43d4d834c7
SSDEEP

12288:VP2nI91nFoMW9XeJSGadgR0O+VPhV/2DyqHO/Dzy4wE4rieJ:VY2BadgRLgP1hbzy4Yrl

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1820	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1820	AUDIODG.EXE
Token: 33	1820	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1820	AUDIODG.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1424 wrote to memory of 544	1424	regsvr32.exe	regsvr32.exe
PID 1424 wrote to memory of 544	1424	regsvr32.exe	regsvr32.exe
PID 1424 wrote to memory of 544	1424	regsvr32.exe	regsvr32.exe
PID 1424 wrote to memory of 544	1424	regsvr32.exe	regsvr32.exe
PID 1424 wrote to memory of 544	1424	regsvr32.exe	regsvr32.exe
PID 1424 wrote to memory of 544	1424	regsvr32.exe	regsvr32.exe
PID 1424 wrote to memory of 544	1424	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\765327e1dc0888c69c92203d90037c5154db9787f54d3fc8f1097830be8c76ab.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1424

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\765327e1dc0888c69c92203d90037c5154db9787f54d3fc8f1097830be8c76ab.dll
2⤵
PID:544

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1820

memory/544-55-0x0000000000000000-mapping.dmp

Download
memory/544-56-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/544-57-0x00000000001D0000-0x000000000020F000-memory.dmp

Filesize
252KB

Download
memory/544-63-0x00000000001D0000-0x000000000020F000-memory.dmp

Filesize
252KB

Download
memory/1424-54-0x000007FEFBD11000-0x000007FEFBD13000-memory.dmp

Filesize
8KB

Download