beed8252f2a42d067f0e24e333ef0abfcafc5a506e1331c94aefd49a4b52ec6d | Triage

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
29/08/2023, 17:18

Sharing

Report Analysis Logs

General

Target

dinput8.dll
Size

7.6MB
MD5

55a6b3e838c35f7a48149c0905cff10e
SHA1

172887ddbdb738de28cb223110291350fe575be0
SHA256

4b19240251dedab6e2f3bc738f6cbd86194d49a2394e165aae3eb7391891b8e1
SHA512

947afd7e23c9c3ce239f5ba85a98688e9dffe554655a7c2224b2086d0462cffc2f66a40cf9eb497b06715cf5890be5979ad39d2ba84dc89ec641d15c17e4be0d
SSDEEP

98304:F3QqEaDsI75nmYqJO1QrmbbOmYzAUwKHj1:F3Q9aDsI9nmYqJOeqXYEiJ

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\test.txt	rundll32.exe
File opened for modification	C:\Windows\system32\test_dir	rundll32.exe
File created	C:\Windows\system32\re2_framework_log.txt	rundll32.exe
File opened for modification	C:\Windows\system32\re2_framework_log.txt	rundll32.exe
File created	C:\Windows\system32\reframework_crash.dmp	rundll32.exe
File created	C:\Windows\system32\test.txt	rundll32.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2344	rundll32.exe
2344	rundll32.exe
2344	rundll32.exe
2344	rundll32.exe
2344	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2344	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2344	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dinput8.dll,#1
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads