f026532162c03666219ec32e8b50a7f4413dbc1146d76f784eabcdda340cf24a | Triage

Analysis

max time kernel
7s
max time network
32s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 23:03

Sharing

Report Analysis Logs

General

Target

42029b1d8c704933d3faa38a171788ad.dll
Size

104KB
MD5

42029b1d8c704933d3faa38a171788ad
SHA1

fd41a9ed6a88115256cf6f38abfa15119ab0d8d6
SHA256

f026532162c03666219ec32e8b50a7f4413dbc1146d76f784eabcdda340cf24a
SHA512

2e84b595e924a8bad7bec75e556d887a07d336784be616562195f9b8727f85614c78b757cb795b98a70a6c74e027549332eab657f69d4a2acc068e5d6a3157ac
SSDEEP

1536:ZHJ3pgYYgkFvGpvXQkliATqfim1IA3voNFTOnoT6k:ZpxYg0RkUB2PNxsoT1

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\wsock32.dll	rundll32.exe
File opened for modification	C:\Windows\wsock32.dll	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2932	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2932	2800	rundll32.exe	29
PID 2800 wrote to memory of 2932	2800	rundll32.exe	29
PID 2800 wrote to memory of 2932	2800	rundll32.exe	29
PID 2800 wrote to memory of 2932	2800	rundll32.exe	29
PID 2800 wrote to memory of 2932	2800	rundll32.exe	29
PID 2800 wrote to memory of 2932	2800	rundll32.exe	29
PID 2800 wrote to memory of 2932	2800	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\42029b1d8c704933d3faa38a171788ad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\42029b1d8c704933d3faa38a171788ad.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads