d690d23996aacbb53f3c9cc411b00fd8ad071ce57d0184607c09c0a0cd40d6b6

Analysis

max time kernel
50s
max time network
51s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
05/08/2024, 22:55

Reason

Machine shutdown

Target

axion/axion.dll
Size

7.3MB
MD5

f461a4851b7b13dbe922d9291ca028cc
SHA1

8ed9698833d58a446b7d6bd264196f69e0c4321c
SHA256

99bb0be66f1a99073a533492ab7351bbc94d42f7d5b52bac78abed448b7f6984
SHA512

f176a75036000d97e8a78d6dedeef01ba89b5ecf19241693dc67dc8230be0b9a5f1a5f6f74c252df74bf562f7c2d5e49bc6422f3b123a675b22e7c872748731f
SSDEEP

49152:Yv4QCQlty2QBCYql2sTeKQi4XvJzl/StlnMg8D9vSP3Kvz3gqeWvtAzlun4h/qNl:sO9/Xj/PD9aPMBST/lgQ/6S+ttYzPc

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2684	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2684	AUDIODG.EXE
Token: 33	2684	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2684	AUDIODG.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 1884	448	rundll32.exe	29
PID 448 wrote to memory of 1884	448	rundll32.exe	29
PID 448 wrote to memory of 1884	448	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\axion\axion.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:448
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 448 -s 156
  2⤵
  PID:1884

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x524
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2684

memory/2252-0-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download