b74b1966e5877922e516142b41cab3b19f76994e6a388d864153eb395f6f9801 | Triage

Analysis

max time kernel
130s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 05:33

Sharing

Report Analysis Logs

General

Target

AudioSes.dll
Size

1.1MB
MD5

944054f69136e8c1d99f99915e67c220
SHA1

e1bca7970998cf12f8ba92096e195d629cd287c6
SHA256

b74b1966e5877922e516142b41cab3b19f76994e6a388d864153eb395f6f9801
SHA512

c8c8d6eaa515b91e31eb4d2c7dc2f42764a41a890b571295815a8c831d4c90de5db515a4941ae6af3252da90d150edd30dc496dbf964744861c51fe9babc942b
SSDEEP

24576:2T1XTloKpjVTfTBXOlRYZ/31U0mn6xZ6IZUeIoDmAz8IcT:2T1jlo8V7TBXeY91U0mn6xZ6IZBDmAzY

Score

1^/10

Malware Config

Signatures

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41FCCC3A-1FA1-4949-953A-6EE61C46A4D1}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41FCCC3A-1FA1-4949-953A-6EE61C46A4D1}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 3640	2876	regsvr32.exe	83
PID 2876 wrote to memory of 3640	2876	regsvr32.exe	83
PID 2876 wrote to memory of 3640	2876	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\AudioSes.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\AudioSes.dll
  2⤵
  - Modifies registry class
  PID:3640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads