dd734da63b25cfc2ddbe0be31fc25577bffe846b6171f2ee10f659a9edce1beb | Triage

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 02:12

Sharing

Report Analysis Logs

General

Target

1K-6K后台接力2.20版/cfgdll.dll
Size

57KB
MD5

cae466bc7eed9b385c7ab245251090c0
SHA1

9557828608f7f3d2191d441e4800924372525a4c
SHA256

9538efe16214e1bf1c177210b7422b250fa9f06efcccef47a7eec94d33648db8
SHA512

248d2e713a81e8601ab755bb01f6d32f655eec72ed83a9f03729b686ec36a50f92928d16d1f08b0a803f68779a2411db7f2629997ccae39ad53275aeb0df35d0
SSDEEP

768:4n9ULjLTeEUzO65T5UFhC7NYrGvLETzFNXP8oM4uZL7svBF:4n9ULfTe315U3r570oM4iEF

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2368	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 2368	5100	rundll32.exe	80
PID 5100 wrote to memory of 2368	5100	rundll32.exe	80
PID 5100 wrote to memory of 2368	5100	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1K-6K后台接力2.20版\cfgdll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1K-6K后台接力2.20版\cfgdll.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads