Analysis
- user interaction
yes - max time kernel
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
03/09/2026, 20:11
General
- Target WindowsAudioService.exe
- Size 15.4MB
- Sample260903-yycbjsvflc
- SHA256 f75595d0cb5a43605a5c4d227bbe6fba413110ef8f9338a7bf548d83febdf954
Malware Config
Signatures
- Loads dropped DLL 22 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WindowsAudioService.exe"C:\Users\Admin\AppData\Local\Temp\WindowsAudioService.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\WindowsAudioService.exe"C:\Users\Admin\AppData\Local\Temp\WindowsAudioService.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
_imaging.cp314-win_amd64.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
cd.cp314-win_amd64.pyd
md.cp314-win_amd64.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python3.DLL
python314.dll
select.pyd
Lorem ipsum.txt
unicodedata.pyd
memory/3744-0-0x00007FF754910000-0x00007FF75497D000-memory.dmp
memory/3744-88-0x00007FF754910000-0x00007FF75497D000-memory.dmp
memory/3744-165-0x00007FF754910000-0x00007FF75497D000-memory.dmp
memory/5652-107-0x00007FF8AE280000-0x00007FF8AE50C000-memory.dmp
memory/5652-125-0x00007FF8AE280000-0x00007FF8AE50C000-memory.dmp
memory/5652-85-0x00007FF8C5BF0000-0x00007FF8C5BFD000-memory.dmp
memory/5652-96-0x00007FF8AE6E0000-0x00007FF8AED11000-memory.dmp
memory/5652-94-0x00007FF8C0DD0000-0x00007FF8C0DE4000-memory.dmp
memory/5652-100-0x00007FF8C0EE0000-0x00007FF8C0F09000-memory.dmp
memory/5652-101-0x00007FF8C0D90000-0x00007FF8C0DC6000-memory.dmp
memory/5652-92-0x00007FF754910000-0x00007FF75497D000-memory.dmp
memory/5652-103-0x00007FF8BA0A0000-0x00007FF8BA1F3000-memory.dmp
memory/5652-89-0x00007FF8C5A90000-0x00007FF8C5A9F000-memory.dmp
memory/5652-80-0x00007FF8C0DF0000-0x00007FF8C0E0A000-memory.dmp
memory/5652-65-0x00007FF8C0EE0000-0x00007FF8C0F09000-memory.dmp
memory/5652-67-0x00007FF8C5CB0000-0x00007FF8C5CBF000-memory.dmp
memory/5652-110-0x00007FF8C1A50000-0x00007FF8C1A5D000-memory.dmp
memory/5652-76-0x00007FF8C0E10000-0x00007FF8C0E90000-memory.dmp
memory/5652-113-0x00007FF8C0E10000-0x00007FF8C0E90000-memory.dmp
memory/5652-74-0x00007FF8C0E90000-0x00007FF8C0EBC000-memory.dmp
memory/5652-114-0x00007FF8ADFC0000-0x00007FF8AE277000-memory.dmp
memory/5652-71-0x00007FF8C0EC0000-0x00007FF8C0EDA000-memory.dmp
memory/5652-120-0x00007FF8B64F0000-0x00007FF8B65AE000-memory.dmp
memory/5652-117-0x00007FF8BAB70000-0x00007FF8BABAA000-memory.dmp
memory/5652-121-0x00007FF8C5A90000-0x00007FF8C5A9F000-memory.dmp
memory/5652-122-0x00007FF8C0DD0000-0x00007FF8C0DE4000-memory.dmp
memory/5652-123-0x00007FF8AE6E0000-0x00007FF8AED11000-memory.dmp
memory/5652-124-0x00007FF8C0D90000-0x00007FF8C0DC6000-memory.dmp
memory/5652-93-0x00007FF8AED20000-0x00007FF8AF42D000-memory.dmp
memory/5652-127-0x00007FF754910000-0x00007FF75497D000-memory.dmp
memory/5652-128-0x00007FF8AED20000-0x00007FF8AF42D000-memory.dmp
memory/5652-145-0x00007FF8B64F0000-0x00007FF8B65AE000-memory.dmp
memory/5652-143-0x00007FF8ADFC0000-0x00007FF8AE277000-memory.dmp
memory/5652-144-0x00007FF8BAB70000-0x00007FF8BABAA000-memory.dmp
memory/5652-146-0x00007FF754910000-0x00007FF75497D000-memory.dmp
memory/5652-150-0x00007FF8C0EC0000-0x00007FF8C0EDA000-memory.dmp
memory/5652-156-0x00007FF8C0DD0000-0x00007FF8C0DE4000-memory.dmp
memory/5652-158-0x00007FF8C0D90000-0x00007FF8C0DC6000-memory.dmp
memory/5652-159-0x00007FF8BA0A0000-0x00007FF8BA1F3000-memory.dmp
memory/5652-163-0x00007FF8BAB70000-0x00007FF8BABAA000-memory.dmp
memory/5652-162-0x00007FF8ADFC0000-0x00007FF8AE277000-memory.dmp
memory/5652-164-0x00007FF8B64F0000-0x00007FF8B65AE000-memory.dmp
memory/5652-157-0x00007FF8AE6E0000-0x00007FF8AED11000-memory.dmp
memory/5652-160-0x00007FF8AE280000-0x00007FF8AE50C000-memory.dmp
memory/5652-161-0x00007FF8C1A50000-0x00007FF8C1A5D000-memory.dmp
memory/5652-155-0x00007FF8C5A90000-0x00007FF8C5A9F000-memory.dmp
memory/5652-154-0x00007FF8C5BF0000-0x00007FF8C5BFD000-memory.dmp
memory/5652-147-0x00007FF8AED20000-0x00007FF8AF42D000-memory.dmp
memory/5652-152-0x00007FF8C0E10000-0x00007FF8C0E90000-memory.dmp
memory/5652-151-0x00007FF8C0E90000-0x00007FF8C0EBC000-memory.dmp
memory/5652-149-0x00007FF8C5CB0000-0x00007FF8C5CBF000-memory.dmp
memory/5652-148-0x00007FF8C0EE0000-0x00007FF8C0F09000-memory.dmp
memory/5652-153-0x00007FF8C0DF0000-0x00007FF8C0E0A000-memory.dmp
memory/5652-57-0x00007FF8AED20000-0x00007FF8AF42D000-memory.dmp