d3a0cb879001f164b9c569ab6d94ac29c06065dcd7fdb0a49544f39a42072d6b | Triage

Analysis

max time kernel
146s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 19:53

Sharing

Report Analysis Logs

General

Target

0f0ad35759641dc37d857ade3d889fb5.dll
Size

98KB
MD5

0f0ad35759641dc37d857ade3d889fb5
SHA1

1b673a70483d80b124030dd304e2614899f9b46f
SHA256

d3a0cb879001f164b9c569ab6d94ac29c06065dcd7fdb0a49544f39a42072d6b
SHA512

a17716864f0fb211b1f60c6632698b94bf359ccd6cd82094735feb2389f86678a43953bbab4f056e6d3e1b00e2ee50efa445c87198fe1fdbc8fe80425490e400
SSDEEP

3072:ilEYMEAH0jrUwMa+leeOjIpSfe3amx0VzV:ilE+vgwMvleeeq2Cam+VR

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4956	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 4956	3652	rundll32.exe	15
PID 3652 wrote to memory of 4956	3652	rundll32.exe	15
PID 3652 wrote to memory of 4956	3652	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f0ad35759641dc37d857ade3d889fb5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f0ad35759641dc37d857ade3d889fb5.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4956-2-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/4956-1-0x0000000002BB0000-0x0000000002CB9000-memory.dmp

Filesize
1.0MB

Download
memory/4956-0-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/4956-3-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download