Analysis
- max time kernel
1s - max time network
37s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
22/10/2026, 22:45
General
- Target bin/audtool.exe
- Size 125KB
- Sample261022-2phzhsvtet
- SHA256 e1866cb4c56a4f0319663762c608f90641fef1fed9af4486797f15306e3b5449
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bin\audtool.exe"C:\Users\Admin\AppData\Local\Temp\bin\audtool.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bin\gdbus.exe"C:\Users\Admin\AppData\Local\Temp\bin\gdbus.exe" _win32_run_session_bus2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
org_gtk_gdbus_general
gdbus-nonce-file-F5NTX3
memory/4344-16-0x00007FF6C5920000-0x00007FF6C5934000-memory.dmp
memory/4344-19-0x00007FFD0DF00000-0x00007FFD0E082000-memory.dmp
memory/4344-20-0x00007FFD20030000-0x00007FFD2008C000-memory.dmp
memory/4344-21-0x00007FFD0DDE0000-0x00007FFD0DEFE000-memory.dmp
memory/4344-22-0x00007FFD24BF0000-0x00007FFD24C15000-memory.dmp
memory/4344-23-0x00007FFD20010000-0x00007FFD2001E000-memory.dmp
memory/4344-24-0x00007FFD1A810000-0x00007FFD1A8C6000-memory.dmp
memory/4344-25-0x00007FFD20020000-0x00007FFD20030000-memory.dmp
memory/4344-18-0x00007FFD0E5A0000-0x00007FFD0E770000-memory.dmp
memory/4344-17-0x00007FFD1B5B0000-0x00007FFD1B602000-memory.dmp
memory/6020-13-0x00007FFD20010000-0x00007FFD2001E000-memory.dmp
memory/6020-10-0x00007FFD1B5B0000-0x00007FFD1B602000-memory.dmp
memory/6020-8-0x00007FFD20030000-0x00007FFD2008C000-memory.dmp
memory/6020-7-0x00007FFD0E5A0000-0x00007FFD0E770000-memory.dmp
memory/6020-9-0x00007FFD0DF00000-0x00007FFD0E082000-memory.dmp
memory/6020-11-0x00007FFD24BF0000-0x00007FFD24C15000-memory.dmp
memory/6020-12-0x00007FFD20020000-0x00007FFD20030000-memory.dmp
memory/6020-14-0x00007FFD1A810000-0x00007FFD1A8C6000-memory.dmp
memory/6020-15-0x00007FFD0DDE0000-0x00007FFD0DEFE000-memory.dmp
memory/6020-6-0x00007FF60D230000-0x00007FF60D255000-memory.dmp