86e376774660522aeafc1182dfd1ea7af602bee39de78c44ffbfa5a4ab109cec | Triage

Resubmissions

08-04-2024 21:40

240408-1h8qxsfh61 10

08-04-2024 20:47

240408-zkt5wabe38 10

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-04-2024 20:47

Sharing

Report Analysis Logs

General

Target

version1.dll
Size

1.4MB
MD5

f834dfc1861cd6361f34496c3bbafe66
SHA1

a983e82d009901310c8a3255c4b4e3a02d556fa7
SHA256

e99f3517a36a9f7a55335699cfb4d84d08b042d47146119156f7f3bab580b4d7
SHA512

088a6170c948ddb2c2b0cf2431ae61688201ef5bc3f1af217a58bf18b26dd9e0ab7ee082f822e736d0467f62e33bf71b806127eb998bed8e739c1e441ac05e00
SSDEEP

12288:kX/1RzJk1HRqZr4y6mLsM5k6tQqNaCPWIzv:+XzJk1HwZL6GQCPP

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1560	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1560	AUDIODG.EXE
Token: 33	1560	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1560	AUDIODG.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2920	2336	rundll32.exe	28
PID 2336 wrote to memory of 2920	2336	rundll32.exe	28
PID 2336 wrote to memory of 2920	2336	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\version1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2336 -s 84
  2⤵
  PID:2920

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
PID:820

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4c4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads