Analysis
-
max time kernel
88s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
22-06-2023 20:08
Behavioral task
behavioral1
Sample
d3a05c8ea550c02fd54bfef2cc474079b323c224dcc39aed7bbe5e350da95d57.dll
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
d3a05c8ea550c02fd54bfef2cc474079b323c224dcc39aed7bbe5e350da95d57.dll
Resource
win10v2004-20230621-en
General
-
Target
d3a05c8ea550c02fd54bfef2cc474079b323c224dcc39aed7bbe5e350da95d57.dll
-
Size
374KB
-
MD5
93b9df578e39aae757e86410bb73f75b
-
SHA1
dd89787fc16cada85fec5cf8358285e12540229d
-
SHA256
d3a05c8ea550c02fd54bfef2cc474079b323c224dcc39aed7bbe5e350da95d57
-
SHA512
578c3721a2b2aa4a43bb7fd9ebdf77f4ef92df4951a55e806d350266d5afc8c612a64d78bfa275b80ff48c8884ac22040712fd3379a0f145c2b4501f1099d147
-
SSDEEP
6144:jJa46VMtgMUfzG0Vo0iKIZt2gaQlD4dLaFjXiFNUj2s9AT13z7:QKmM2e0iyQl4dLwjXHdux
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
rundll32.exepid process 4736 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4724 wrote to memory of 4736 4724 rundll32.exe rundll32.exe PID 4724 wrote to memory of 4736 4724 rundll32.exe rundll32.exe PID 4724 wrote to memory of 4736 4724 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d3a05c8ea550c02fd54bfef2cc474079b323c224dcc39aed7bbe5e350da95d57.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d3a05c8ea550c02fd54bfef2cc474079b323c224dcc39aed7bbe5e350da95d57.dll,#12⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4736-133-0x0000000010000000-0x00000000100EC000-memory.dmpFilesize
944KB
-
memory/4736-134-0x0000000010000000-0x00000000100EC000-memory.dmpFilesize
944KB
-
memory/4736-135-0x0000000010000000-0x00000000100EC000-memory.dmpFilesize
944KB
-
memory/4736-136-0x0000000010000000-0x00000000100EC000-memory.dmpFilesize
944KB
-
memory/4736-137-0x0000000010000000-0x00000000100EC000-memory.dmpFilesize
944KB