22905cd74085b5b80d07f0ec1cd0ed187400ac63e4601c0244317b60206ae0b7

Resubmissions

12-11-2024 03:23

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-11-2024 03:23

Target

VytrixDuper.exe
Size

22.8MB
MD5

d13ae015a085b21c90f987ed36574e2d
SHA1

2488d03a0b5f72153c89089536d8c2d27527e973
SHA256

c0a3974d6029fd96b68a40c3fe56c56868a1c68ef9a128ae7d9c24ddc5785c5b
SHA512

29e0d67b71ac7aec66de9b38edeea15159e50fa7a4d96925dc578ab5ae7f31509716a7b15eadb7e1eeb614762332ca95692eb423488912b3bd9bd28c6a07601c
SSDEEP

393216:uJ/+tByxjBIn8iK1piXLGVEgMv0XXsgyYWZBo:DtAjhDiXHjvmYBo

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2620	VytrixDuper.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral5/files/0x000500000001a4b9-61.dat	upx
behavioral5/memory/2620-63-0x000007FEF5A90000-0x000007FEF60F3000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2256	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2256	AUDIODG.EXE
Token: 33	2256	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2256	AUDIODG.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2620	2420	VytrixDuper.exe	30
PID 2420 wrote to memory of 2620	2420	VytrixDuper.exe	30
PID 2420 wrote to memory of 2620	2420	VytrixDuper.exe	30

C:\Users\Admin\AppData\Local\Temp\VytrixDuper.exe
"C:\Users\Admin\AppData\Local\Temp\VytrixDuper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Users\Admin\AppData\Local\Temp\VytrixDuper.exe
  "C:\Users\Admin\AppData\Local\Temp\VytrixDuper.exe"
  2⤵
  - Loads dropped DLL
  PID:2620

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x17c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2256

C:\Users\Admin\AppData\Local\Temp\_MEI24202\python313.dll

Filesize
1.8MB

MD5
d99ac8bac1343105b642295397ca2ffc

SHA1
93fd73c1fb9ee99ddc66d38885a657cf81f62836

SHA256
9116e56cedeb1c4ae82b4bde560f2fe0b83a16764865012cbf5501673d3c5536

SHA512
89d30bc84978daf469008ffc347cbd3e189f1df2c1a302dedfc2b700267cc28c671c7c35b5e95ba29a300e7fda75ccfc720d2173ea6db6eb69978772c0b8339f

Download Submit
memory/2620-63-0x000007FEF5A90000-0x000007FEF60F3000-memory.dmp

Filesize
6.4MB

Download