Analysis
-
max time kernel
140s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
19-06-2023 18:24
Behavioral task
behavioral1
Sample
41fcd5be341624a3ab198101c8b623e3321adeb62198a29b907d6b231fc69e73.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
41fcd5be341624a3ab198101c8b623e3321adeb62198a29b907d6b231fc69e73.dll
Resource
win10v2004-20230220-en
General
-
Target
41fcd5be341624a3ab198101c8b623e3321adeb62198a29b907d6b231fc69e73.dll
-
Size
401KB
-
MD5
297921cf5922b8dab498b1f2c026f28f
-
SHA1
d069f3c71ae4dbd07529a5fa0ac465284d85715c
-
SHA256
41fcd5be341624a3ab198101c8b623e3321adeb62198a29b907d6b231fc69e73
-
SHA512
b81e06ae381270efba09802f27ae9e0c42ea1e3291602a5ca443422e3204524e404297106fedd6b2e4b7318dcf839ae5b2e9535174c3b7706546d52d3ca14022
-
SSDEEP
6144:5k07oJEdZBAw9NWUojKsJXDJfKqgOi1GDhCU4be6LxNYb3MKnkQdUQDC6qJDl:XAwnWUojVNdsF1GcUYLxN4MAPCnN
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
rundll32.exepid process 1700 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1976 wrote to memory of 1700 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1700 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1700 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1700 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1700 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1700 1976 rundll32.exe rundll32.exe PID 1976 wrote to memory of 1700 1976 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\41fcd5be341624a3ab198101c8b623e3321adeb62198a29b907d6b231fc69e73.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\41fcd5be341624a3ab198101c8b623e3321adeb62198a29b907d6b231fc69e73.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:1700
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1700-54-0x0000000001DB0000-0x0000000001EFD000-memory.dmpFilesize
1.3MB
-
memory/1700-55-0x0000000001DB0000-0x0000000001EFD000-memory.dmpFilesize
1.3MB
-
memory/1700-56-0x0000000001DB0000-0x0000000001EFD000-memory.dmpFilesize
1.3MB
-
memory/1700-57-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB