Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
22-02-2023 19:29
Behavioral task
behavioral1
Sample
1478bfb769cb10ccb660d0e8c61fb1526233028e78c640785a08e5f2810a30d3.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1478bfb769cb10ccb660d0e8c61fb1526233028e78c640785a08e5f2810a30d3.dll
Resource
win10v2004-20230220-en
General
-
Target
1478bfb769cb10ccb660d0e8c61fb1526233028e78c640785a08e5f2810a30d3.dll
-
Size
401KB
-
MD5
9ee325a3be6098d2096dbc8358537ae8
-
SHA1
bb37feb51d6840e66522878a800a4dff1e34b53f
-
SHA256
1478bfb769cb10ccb660d0e8c61fb1526233028e78c640785a08e5f2810a30d3
-
SHA512
b6874853639ba5347db40f9c1ba8a76e647f3f83347c54f85918f71945525c47b569c447c1ba621307a1d0c0c251edc550bca9ca225d42d0f6dade7b7cf7d904
-
SSDEEP
6144:5k07oJEdZBAw9NWUojKsJXDJfKqgOi1GDhCU4be6LxNYb3MKnGvU9DC9ayJDV:XAwnWUojVNdsF1GcUYLxN4MaChN
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
rundll32.exepid process 2884 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 5084 wrote to memory of 2884 5084 rundll32.exe rundll32.exe PID 5084 wrote to memory of 2884 5084 rundll32.exe rundll32.exe PID 5084 wrote to memory of 2884 5084 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1478bfb769cb10ccb660d0e8c61fb1526233028e78c640785a08e5f2810a30d3.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1478bfb769cb10ccb660d0e8c61fb1526233028e78c640785a08e5f2810a30d3.dll,#12⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2884-133-0x0000000000400000-0x000000000054D000-memory.dmpFilesize
1.3MB
-
memory/2884-134-0x0000000000400000-0x000000000054D000-memory.dmpFilesize
1.3MB
-
memory/2884-135-0x0000000000400000-0x000000000054D000-memory.dmpFilesize
1.3MB
-
memory/2884-136-0x00000000012A0000-0x00000000012A1000-memory.dmpFilesize
4KB