Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
09-02-2023 07:07
Behavioral task
behavioral1
Sample
a77026369a419d406016777fa7e8e6807a4c2ae6e2dab8a86e49ed9c53ae56df.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a77026369a419d406016777fa7e8e6807a4c2ae6e2dab8a86e49ed9c53ae56df.dll
Resource
win10v2004-20221111-en
General
-
Target
a77026369a419d406016777fa7e8e6807a4c2ae6e2dab8a86e49ed9c53ae56df.dll
-
Size
369KB
-
MD5
0d570f6da1c962502b0f54307b0d9abf
-
SHA1
78b84f9692c5d06e639687031758f3f2879e5844
-
SHA256
a77026369a419d406016777fa7e8e6807a4c2ae6e2dab8a86e49ed9c53ae56df
-
SHA512
0407c0e365514951dbb96dab5b9c31c24606fab62be67b262b030d3da79f2df98a38b0a43a846a785c92463318d13ce582a0b3aa345dcdd3de01a2247b6b8bc1
-
SSDEEP
6144:ey4m1oD0paFOpmC68BiK9cp7W0tp818tJT0oVlTB9PYa5haic:yeS0oA68iKydpo8tVP3BZH
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
rundll32.exepid process 948 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2024 wrote to memory of 948 2024 rundll32.exe rundll32.exe PID 2024 wrote to memory of 948 2024 rundll32.exe rundll32.exe PID 2024 wrote to memory of 948 2024 rundll32.exe rundll32.exe PID 2024 wrote to memory of 948 2024 rundll32.exe rundll32.exe PID 2024 wrote to memory of 948 2024 rundll32.exe rundll32.exe PID 2024 wrote to memory of 948 2024 rundll32.exe rundll32.exe PID 2024 wrote to memory of 948 2024 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a77026369a419d406016777fa7e8e6807a4c2ae6e2dab8a86e49ed9c53ae56df.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a77026369a419d406016777fa7e8e6807a4c2ae6e2dab8a86e49ed9c53ae56df.dll,#12⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/948-54-0x0000000000000000-mapping.dmp
-
memory/948-55-0x00000000759F1000-0x00000000759F3000-memory.dmpFilesize
8KB
-
memory/948-57-0x0000000010000000-0x00000000100D2000-memory.dmpFilesize
840KB
-
memory/948-58-0x0000000010000000-0x00000000100D2000-memory.dmpFilesize
840KB
-
memory/948-56-0x0000000010000000-0x00000000100D2000-memory.dmpFilesize
840KB
-
memory/948-59-0x0000000010000000-0x00000000100D2000-memory.dmpFilesize
840KB
-
memory/948-60-0x0000000010000000-0x00000000100D2000-memory.dmpFilesize
840KB
-
memory/948-61-0x0000000010000000-0x00000000100D2000-memory.dmpFilesize
840KB