46d15d49c641f1a0645fbd011449ac4ae40f9c9b627e4544427d57650a8909a7 | Triage

Analysis

max time kernel
124s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2023 16:35

Sharing

Report Analysis Logs

General

Target

dinput8.dll
Size

10.7MB
MD5

21992a8183018c80f35f12783bf1065b
SHA1

7424d17b5e409fcd289c132a94bfebd011ddafd5
SHA256

8a80f4508ff7ea0066a9aeaab335e26c3f4262ca6a4836ec5e19cf9cd8d4b5ca
SHA512

9b2648485c7c9da6c004db15579abb95c965736f30e18c6ef373c8f8364feed3adb46ab766680b9bdcd3a809b184d9b30fd9278d993da57c28dbe0511a5f330f
SSDEEP

196608:LdixOqTtNJR0sB7GTGPa+HNSSJcQGp90nu:LlqhPRthC+HMSJcQGp98

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\system32\re2_framework_log.txt	rundll32.exe
File opened for modification	C:\Windows\system32\re2_framework_log.txt	rundll32.exe
File created	C:\Windows\system32\reframework_crash.dmp	rundll32.exe
File created	C:\Windows\system32\test.txt	rundll32.exe
File opened for modification	C:\Windows\system32\test.txt	rundll32.exe
File opened for modification	C:\Windows\system32\test_dir	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2988	rundll32.exe
2988	rundll32.exe
2988	rundll32.exe
2988	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2988	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dinput8.dll,#1
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads