e8a8a90e1e493f006bddc6e97022fec4360afb8e298d7260b211fc6977ee91a2

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 21:53

Reason

Machine shutdown

Target

e8a8a90e1e493f006bddc6e97022fec4360afb8e298d7260b211fc6977ee91a2.dll
Size

56KB
MD5

3c9428f4e5aec04fe120dd3f52bf1f6e
SHA1

3df4fd4f8c80f32c24f390729666656a48374f7b
SHA256

e8a8a90e1e493f006bddc6e97022fec4360afb8e298d7260b211fc6977ee91a2
SHA512

f65fba19ad90f5ca4e122e0523bd52bfb9858cb8f9d4ddec9e5daa52fd70e5354071775d285d812452bd905a5b39fe6f2646571752454ee1e9f5510db90c82c3
SSDEEP

768:OTEaIkoa7El/ZiLA7cbYzHRdpT01qVLWaIWOB41YQGRwJ9y59ocw3Qi:C2kQ6XEbRzT01qVLWGzYBwJ09ox3

Score

1^/10

Suspicious behavior: EnumeratesProcesses 21 IoCs

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2044	rundll32.exe
Token: 33	1772	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1772	AUDIODG.EXE
Token: 33	1772	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1772	AUDIODG.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27
PID 1184 wrote to memory of 2044	1184	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e8a8a90e1e493f006bddc6e97022fec4360afb8e298d7260b211fc6977ee91a2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e8a8a90e1e493f006bddc6e97022fec4360afb8e298d7260b211fc6977ee91a2.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2044

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1772

memory/784-56-0x000007FEFB631000-0x000007FEFB633000-memory.dmp

Filesize
8KB

Download
memory/2044-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download