Analysis
-
max time kernel
102s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
10-02-2023 19:47
Behavioral task
behavioral1
Sample
55f5e635cda9d4035a5cdbf858b5b568c76241150acce596457414a5f0a95b03.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
55f5e635cda9d4035a5cdbf858b5b568c76241150acce596457414a5f0a95b03.dll
Resource
win10v2004-20220901-en
General
-
Target
55f5e635cda9d4035a5cdbf858b5b568c76241150acce596457414a5f0a95b03.dll
-
Size
401KB
-
MD5
b16ab069535e26e72729c8cc58cdd53f
-
SHA1
b71abab64b2714e20ac73b56c0f8bc907b61e740
-
SHA256
55f5e635cda9d4035a5cdbf858b5b568c76241150acce596457414a5f0a95b03
-
SHA512
e30b70fc11ef1d8d823fb0e1c0235d908fec1c2331beb8b3a85890d4d0266ae0288bf8244d7026a052d5424a522a81f6b655d05fd2feb0fd7c116acd9a74eb08
-
SSDEEP
6144:5k07oJEdZBAw9NWUojKsJXDJfKqgOi1GDhCU4be6LxNYb3MKnGvU9DC9WKJDV:XAwnWUojVNdsF1GcUYLxN4MaCRN
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
rundll32.exepid process 5076 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 5060 wrote to memory of 5076 5060 rundll32.exe rundll32.exe PID 5060 wrote to memory of 5076 5060 rundll32.exe rundll32.exe PID 5060 wrote to memory of 5076 5060 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\55f5e635cda9d4035a5cdbf858b5b568c76241150acce596457414a5f0a95b03.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\55f5e635cda9d4035a5cdbf858b5b568c76241150acce596457414a5f0a95b03.dll,#12⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5076-132-0x0000000000000000-mapping.dmp
-
memory/5076-133-0x0000000000400000-0x000000000054D000-memory.dmpFilesize
1.3MB
-
memory/5076-134-0x0000000000400000-0x000000000054D000-memory.dmpFilesize
1.3MB
-
memory/5076-135-0x0000000000400000-0x000000000054D000-memory.dmpFilesize
1.3MB