9b1becaae353cfed426aac596fdaee9a343dffbdae42e3be55f245cd16be4b6a | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 11:27

Sharing

Report Analysis Logs

General

Target

AudioDevice.dll
Size

32KB
MD5

f3e7ab1a7f63e2252f2a5b2f4cae530b
SHA1

e8fcc1d8e458b031c63e4be8d0a71fc0442c65a4
SHA256

5ec4a2ad48a06ae86d2020324a4b0d22d7317c26543e30b08fb33b253c5dad31
SHA512

c10507c7aa2e72dfbd585a983623627a9240bbf1fa63ba7fca9f8068e848a2b610bd1e2570d78d99dab270f481efc774465a25df782ec5ec790733dd7fc3c538
SSDEEP

384:H0IFEUAnuspBauANAtGZDkOZ/SHmcCQh:HVAnXpZ2At6DkRmF8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2860 wrote to memory of 2912	2860	regsvr32.exe	regsvr32.exe
PID 2860 wrote to memory of 2912	2860	regsvr32.exe	regsvr32.exe
PID 2860 wrote to memory of 2912	2860	regsvr32.exe	regsvr32.exe
PID 2860 wrote to memory of 2912	2860	regsvr32.exe	regsvr32.exe
PID 2860 wrote to memory of 2912	2860	regsvr32.exe	regsvr32.exe
PID 2860 wrote to memory of 2912	2860	regsvr32.exe	regsvr32.exe
PID 2860 wrote to memory of 2912	2860	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\AudioDevice.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2860

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\AudioDevice.dll
2⤵
PID:2912

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...