a5fc814ab0a22c9684cb7587ffed6a7188e0a061ef4a268b4997e38a5f86aabd | Triage

Resubmissions

14-02-2023 11:56

230214-n4ad2ace4y 10

09-02-2023 19:59

230209-yqlv1sah97 3

Analysis

max time kernel
151s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09-02-2023 19:59

Sharing

Report Analysis Logs

General

Target

suspicious.dll
Size

1.7MB
MD5

ace1226b3f17cf0cb6e6c3ceae7b95d8
SHA1

369ca9e31a31709641c2491bb895d55b20d5c90c
SHA256

a5fc814ab0a22c9684cb7587ffed6a7188e0a061ef4a268b4997e38a5f86aabd
SHA512

dba25ddeffe58e9258ce39aa3bd1509b6ce115fb6f097992fcce97134f8c7a212dfe5a4061c5c5fadaeba131b3336ccdb3cd79aa01dc53b4f063f6ebd7212540
SSDEEP

24576:nrj3nPW3ednWPiT8VTBqcATV8KIyydLXGcq8z+0uaEYmgE7v99de7:f3nCeCiT8aHxyM18z+XatEh9de

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1528 1176 WerFault.exe rundll32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1756	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1756	AUDIODG.EXE
Token: 33	1756	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1756	AUDIODG.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1200 wrote to memory of 1176	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 1176	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 1176	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 1176	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 1176	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 1176	1200	rundll32.exe	rundll32.exe
PID 1200 wrote to memory of 1176	1200	rundll32.exe	rundll32.exe
PID 1176 wrote to memory of 1528	1176	rundll32.exe	WerFault.exe
PID 1176 wrote to memory of 1528	1176	rundll32.exe	WerFault.exe
PID 1176 wrote to memory of 1528	1176	rundll32.exe	WerFault.exe
PID 1176 wrote to memory of 1528	1176	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\suspicious.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1200

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\suspicious.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 228
3⤵
- Program crash
PID:1528

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1052

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x520
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1756

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1052-57-0x000007FEFB751000-0x000007FEFB753000-memory.dmp

Filesize
8KB

Download
memory/1176-54-0x0000000000000000-mapping.dmp

Download
memory/1176-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1528-56-0x0000000000000000-mapping.dmp

Download