120edd37142c24d17472137c608220220a4efb595d42a991efd498ac30339b4e

Resubmissions

24/11/2022, 10:37

24/11/2022, 10:33

24/11/2022, 10:30

24/11/2022, 10:26

max time kernel
141s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 10:26

Target

Server.exe
Size

150KB
MD5

0f367fce0c77e594ec09f105ded2503a
SHA1

fba1dd99300e2c9d574a4afa976590b6da35ee50
SHA256

120edd37142c24d17472137c608220220a4efb595d42a991efd498ac30339b4e
SHA512

a8a6d855805f9e223478191577bbe981d09b988fdb20c64fa62431587b122424b2d868f82feaeb3e5be6e4aa49ccc3cf842c592ead2d8c645f497f1b69764f3f
SSDEEP

3072:+FhkwDd+B2lf1oJWT9RMkjWyqQuRN4GepKsqL4:+Pk0d+Bo6JWT93q9/4

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	624	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	624	AUDIODG.EXE
Token: 33	624	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	624	AUDIODG.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2028	1768	Server.exe	28
PID 1768 wrote to memory of 2028	1768	Server.exe	28
PID 1768 wrote to memory of 2028	1768	Server.exe	28
PID 1768 wrote to memory of 2028	1768	Server.exe	28
PID 956 wrote to memory of 1308	956	Server.exe	40
PID 956 wrote to memory of 1308	956	Server.exe	40
PID 956 wrote to memory of 1308	956	Server.exe	40
PID 956 wrote to memory of 1308	956	Server.exe	40
PID 948 wrote to memory of 1820	948	Server.exe	43
PID 948 wrote to memory of 1820	948	Server.exe	43
PID 948 wrote to memory of 1820	948	Server.exe	43
PID 948 wrote to memory of 1820	948	Server.exe	43

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 440
  2⤵
  PID:2028

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x188
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:624

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" shell32.dll,Options_RunDLL 0
1⤵
PID:1716

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 440
  2⤵
  PID:1308

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 440
  2⤵
  PID:1820

memory/948-67-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/948-68-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/948-69-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/956-62-0x0000000074C40000-0x00000000751EB000-memory.dmp

Filesize
5.7MB

Download
memory/956-63-0x0000000074C40000-0x00000000751EB000-memory.dmp

Filesize
5.7MB

Download
memory/1768-54-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/1768-57-0x0000000074DB0000-0x000000007535B000-memory.dmp

Filesize
5.7MB

Download
memory/1768-58-0x0000000074DB0000-0x000000007535B000-memory.dmp

Filesize
5.7MB

Download