eb2544f1996d6687c5f94f6a74fe0c27279a2d5ffad99e76d7d0e24c290b81be | Triage

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 14:46

Sharing

Report Analysis Logs

General

Target

PicMan.dll
Size

28KB
MD5

00cc4dd98373baea21e6768b1761ed38
SHA1

4987dd5547aedff1348c22831fe764ccf1234328
SHA256

b592ff15b6718338a13b2998f025ca428eb38336848c94fbae14142b42909f5b
SHA512

6102fd5c3648798b352439272d501f82bfa6e3fb5365e29ac2e8d10c43ba7176f4b1161be29134e82f40d795a6d23e3db64621c414df92525ddc0f64ede26697
SSDEEP

384:yoDHQdCP6n0SYI/5w2dgnP6i63IbByHiiUP:RDwy60gw2enP6izi

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1344	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PicMan.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PicMan.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1344-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download