495019c56173709f29bca35b101b8e06724df84075fc42bf8f76e772f0ec1c65

Analysis

max time kernel
118s
max time network
285s
platform
windows10-2004_x64
resource
win10v2004-20231215-es
resource tags

arch:x64arch:x86image:win10v2004-20231215-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
30/12/2023, 00:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OfficeSharing RJ311604/OfficeSharing/OfficeSharing_Windows/Office Sharing.exe
Size

625KB
MD5

336e99598680dafe383075171e03514c
SHA1

71674f9da0c61bc8a25cff3a2dc5467e62add018
SHA256

7add9772a39b830fab3e7696ae00523bb2046383d4c19f7df5d107e9a8174e5c
SHA512

7adc5326921a43a89aea4573917b9af36455e4fa4d03c862e6ce933704062618060744687377a962938f9b4dca2e19a43a92802786eade9a092ab1b9e3ef47a5
SSDEEP

3072:kVlAZX7pQWDRub+S1xZcrvfNGlbTS8leKZHLvNAzRIM/XTHlFvwkC0YVvrmspch3:kVls9uueVFCP

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4800	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4800	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
784	Office Sharing.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 2404	784	Office Sharing.exe	87
PID 784 wrote to memory of 2404	784	Office Sharing.exe	87
PID 784 wrote to memory of 2404	784	Office Sharing.exe	87
PID 2404 wrote to memory of 3288	2404	UnityCrashHandler32.exe	97
PID 2404 wrote to memory of 3288	2404	UnityCrashHandler32.exe	97
PID 2404 wrote to memory of 3288	2404	UnityCrashHandler32.exe	97

C:\Users\Admin\AppData\Local\Temp\OfficeSharing RJ311604\OfficeSharing\OfficeSharing_Windows\Office Sharing.exe
"C:\Users\Admin\AppData\Local\Temp\OfficeSharing RJ311604\OfficeSharing\OfficeSharing_Windows\Office Sharing.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:784
- C:\Users\Admin\AppData\Local\Temp\OfficeSharing RJ311604\OfficeSharing\OfficeSharing_Windows\UnityCrashHandler32.exe
  "C:\Users\Admin\AppData\Local\Temp\OfficeSharing RJ311604\OfficeSharing\OfficeSharing_Windows\UnityCrashHandler32.exe" --attach 784 52498432
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Users\Admin\AppData\Local\Temp\OfficeSharing RJ311604\OfficeSharing\OfficeSharing_Windows\UnityCrashHandler32.exe
    "C:\Users\Admin\AppData\Local\Temp\OfficeSharing RJ311604\OfficeSharing\OfficeSharing_Windows\UnityCrashHandler32.exe" "784" "52498432"
    3⤵
    PID:3288

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e8 0x4ac
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/784-0-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download
memory/784-1-0x0000000003280000-0x0000000003290000-memory.dmp

Filesize
64KB

Download
memory/784-2-0x000000000BCB0000-0x000000000BCC0000-memory.dmp

Filesize
64KB

Download
memory/784-3-0x000000000FCB0000-0x000000000FCC0000-memory.dmp

Filesize
64KB

Download
memory/784-4-0x000000000FCE0000-0x000000000FCF0000-memory.dmp

Filesize
64KB

Download
memory/784-5-0x000000000DCC0000-0x000000000DCD0000-memory.dmp

Filesize
64KB

Download
memory/784-6-0x000000000DCD0000-0x000000000DCF0000-memory.dmp

Filesize
128KB

Download
memory/784-7-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download
memory/784-8-0x0000000003280000-0x0000000003290000-memory.dmp

Filesize
64KB

Download
memory/784-9-0x000000000F440000-0x000000000F450000-memory.dmp

Filesize
64KB

Download
memory/784-10-0x000000000F460000-0x000000000F470000-memory.dmp

Filesize
64KB

Download
memory/784-11-0x000000000FB60000-0x000000000FB70000-memory.dmp

Filesize
64KB

Download
memory/784-13-0x000000000BCB0000-0x000000000BCC0000-memory.dmp

Filesize
64KB

Download
memory/784-14-0x000000000FB80000-0x000000000FB90000-memory.dmp

Filesize
64KB

Download
memory/784-15-0x000000000FCB0000-0x000000000FCC0000-memory.dmp

Filesize
64KB

Download
memory/784-16-0x000000000FB90000-0x000000000FBA0000-memory.dmp

Filesize
64KB

Download
memory/784-12-0x000000000FB70000-0x000000000FB80000-memory.dmp

Filesize
64KB

Download
memory/784-17-0x000000000F290000-0x000000000F2A0000-memory.dmp

Filesize
64KB

Download
memory/784-18-0x000000000FCE0000-0x000000000FCF0000-memory.dmp

Filesize
64KB

Download
memory/784-19-0x000000000DCC0000-0x000000000DCD0000-memory.dmp

Filesize
64KB

Download
memory/784-20-0x000000000FBC0000-0x000000000FBD0000-memory.dmp

Filesize
64KB

Download
memory/784-21-0x000000000DCD0000-0x000000000DCF0000-memory.dmp

Filesize
128KB

Download
memory/784-22-0x000000000F440000-0x000000000F450000-memory.dmp

Filesize
64KB

Download
memory/784-23-0x000000000F460000-0x000000000F470000-memory.dmp

Filesize
64KB

Download
memory/784-24-0x000000000FB60000-0x000000000FB70000-memory.dmp

Filesize
64KB

Download
memory/784-25-0x000000000FB70000-0x000000000FB80000-memory.dmp

Filesize
64KB

Download
memory/784-26-0x000000000FB80000-0x000000000FB90000-memory.dmp

Filesize
64KB

Download
memory/784-27-0x000000000FB90000-0x000000000FBA0000-memory.dmp

Filesize
64KB

Download
memory/784-28-0x000000000F290000-0x000000000F2A0000-memory.dmp

Filesize
64KB

Download
memory/784-29-0x000000000FBC0000-0x000000000FBD0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads