eb2544f1996d6687c5f94f6a74fe0c27279a2d5ffad99e76d7d0e24c290b81be | Triage

Analysis

max time kernel
150s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 14:46

Sharing

Report Analysis Logs

General

Target

PicMan.dll
Size

28KB
MD5

00cc4dd98373baea21e6768b1761ed38
SHA1

4987dd5547aedff1348c22831fe764ccf1234328
SHA256

b592ff15b6718338a13b2998f025ca428eb38336848c94fbae14142b42909f5b
SHA512

6102fd5c3648798b352439272d501f82bfa6e3fb5365e29ac2e8d10c43ba7176f4b1161be29134e82f40d795a6d23e3db64621c414df92525ddc0f64ede26697
SSDEEP

384:yoDHQdCP6n0SYI/5w2dgnP6i63IbByHiiUP:RDwy60gw2enP6izi

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1704	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 1704	5100	rundll32.exe	84
PID 5100 wrote to memory of 1704	5100	rundll32.exe	84
PID 5100 wrote to memory of 1704	5100	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PicMan.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PicMan.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads