7d4cc059fd82b52011b02ba850ddf0ac14c06826bde03a13c68ddf3a5531a242

Resubmissions

08-10-2022 15:38

max time kernel
47s
max time network
56s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
08-10-2022 15:38

Target

manycam.7.6.0.38-MPT.exe
Size

229KB
MD5

99bc00543dd33142549458775fc146a8
SHA1

757f6569d16699fdb1f1597d6bac245fe2f88d27
SHA256

3bacbaf79d434a128d3a32792ab8f87aaa4854dacb89f475d4dec0f3addbd33c
SHA512

d77214c376d719217cdf830e4bc41251181750f330e9aa0b9d4ddb2e61959068780e8a2aa1c216f5217954436561bb643112bbf7a3dd269c07257ce8e7d0d8e2
SSDEEP

6144:fodJmiTnPc8G9S7KkzadJeXeD67fOrkz:fPenPcFS2j0eDSOrW

Score

7^/10

Loads dropped DLL 2 IoCs

Processes:

manycam.7.6.0.38-MPT.exe

pid process

1768 manycam.7.6.0.38-MPT.exe
1768 manycam.7.6.0.38-MPT.exe
Drops file in Program Files directory 1 IoCs

Processes:

manycam.7.6.0.38-MPT.exe

description ioc process

File opened for modification C:\Program Files (x86)\ManyCam\ManyCam.exe manycam.7.6.0.38-MPT.exe

pid	process
1768	manycam.7.6.0.38-MPT.exe
1768	manycam.7.6.0.38-MPT.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\ManyCam\ManyCam.exe	manycam.7.6.0.38-MPT.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1716	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1716	AUDIODG.EXE
Token: 33	1716	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1716	AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0xc8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1716

\Users\Admin\AppData\Local\Temp\bassmod.dll
Filesize
33KB

MD5
e4ec57e8508c5c4040383ebe6d367928

SHA1
b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

SHA256
8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

SHA512
77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

Download Submit
\Users\Admin\AppData\Local\Temp\dup2patcher.dll
Filesize
195KB

MD5
0f6a9bbbff53c8c215d1f0ce566b0f5e

SHA1
28906d516edf25fb58b6cc755725fde4504ab5b8

SHA256
380c0e3953de8cd1ce3793930821b85e02e40cfb13be3e1b57a44782f877dbdf

SHA512
a3007152c7927bb57d0887df82966f02fce739f7ce168f7f61676795a0d133519a007f0d2d9e41a645670eafce4b66a1682417e7e4b73973d28187e85c84e255

Download Submit
memory/1768-55-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/1768-57-0x0000000075610000-0x00000000756A0000-memory.dmp

Filesize
576KB

Download
memory/1768-59-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1768-58-0x00000000001F0000-0x00000000001F3000-memory.dmp

Filesize
12KB

Download
memory/1768-60-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download