0658cda97d6fc28bfe8be410cdd1a1900c3f5283ba0b746730d540370615c498 | Triage

Analysis

max time kernel
53s
max time network
62s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19/04/2023, 03:53

Sharing

Report Analysis Logs

General

Target

OpenAL32.dll
Size

975KB
MD5

883083b84f2d080240954facc1769d80
SHA1

e4277ca2afd417d56f583f1a430e5ebea8b3bece
SHA256

14256d3228dfa3af57011c723da1768575e013d126c5ef5c428ecaee1079e836
SHA512

39c5b765ea64447ae6a015e055b3a366cfe91cd27f4fa2adcc85cecf2b1fa8d7a60cac5e049069741c7e163c855bc7e46a1fa1a7eadd162c55cd35e420b5f9b9
SSDEEP

24576:eBfYafzPcBjuqHvBh9PKpuBuAaCi33mgFp:eBwaLPcBjuqZh9P/BuADi33Bp

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	592	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	592	AUDIODG.EXE
Token: 33	592	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	592	AUDIODG.EXE

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\OpenAL32.dll,#1
1⤵
PID:1572

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:936

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x554
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:592

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1572-54-0x00000000752A0000-0x00000000753A2000-memory.dmp

Filesize
1.0MB

Download