db428726787c5962e3fbf0b935a19dfb9b6ca1bea3956171059a74ffa3fce78e | Triage

Analysis

max time kernel
163s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

m3gdkq/cfgdll.dll
Size

57KB
MD5

cae466bc7eed9b385c7ab245251090c0
SHA1

9557828608f7f3d2191d441e4800924372525a4c
SHA256

9538efe16214e1bf1c177210b7422b250fa9f06efcccef47a7eec94d33648db8
SHA512

248d2e713a81e8601ab755bb01f6d32f655eec72ed83a9f03729b686ec36a50f92928d16d1f08b0a803f68779a2411db7f2629997ccae39ad53275aeb0df35d0
SSDEEP

768:4n9ULjLTeEUzO65T5UFhC7NYrGvLETzFNXP8oM4uZL7svBF:4n9ULfTe315U3r570oM4iEF

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4916	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 4916	4180	rundll32.exe	88
PID 4180 wrote to memory of 4916	4180	rundll32.exe	88
PID 4180 wrote to memory of 4916	4180	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\m3gdkq\cfgdll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\m3gdkq\cfgdll.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads