58e9508e363895165bee8892c9fde2c1048d2e000c44fd4bc2be739a37adfb92

Analysis

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
17/02/2023, 05:04

Target

XWorm V3.1 - Copy/Intro.wav
Size

1.7MB
MD5

dc28d546b643c5a33c292ae32d7cf43b
SHA1

b1f891265914eea6926df765bce0f73f8d9d6741
SHA256

20dcc4f50eb47cafda7926735df9ef8241598b83e233066ea495d4b8aa818851
SHA512

9d8c1bb61b6f564044aad931e685387df9bc00a92ab5efe7191b94a3d45c7d98a6f71d8ae5668252d6a7b5b44ab6704464d688772aedac8bdb2773d5765d4d56
SSDEEP

49152:a9ryN00SMMhAAtPU6elXXBjSdCEiV5Chuw4Osgplu:O30SnhAAtPTelHB7EiVfO7s

Score

1^/10

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1740	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1740	vlc.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: 33	528	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	528	AUDIODG.EXE
Token: 33	528	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	528	AUDIODG.EXE
Token: 33	1740	vlc.exe
Token: SeIncBasePriorityPrivilege	1740	vlc.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Suspicious use of SendNotifyMessage 7 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1740	vlc.exe

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x56c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:528

memory/1740-54-0x000007FEFB5E1000-0x000007FEFB5E3000-memory.dmp

Filesize
8KB

Download