cfffbc8a94c9a1cca06a53b6bf460932eed69de24c4bbc5251805f076f651418 | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:24

Sharing

Report Analysis Logs

General

Target

02e2841d7b2d7ed666ef16022fce8eba.dll
Size

105KB
MD5

02e2841d7b2d7ed666ef16022fce8eba
SHA1

72b8ac6caffc3cbd8e988157db435a28ab375c6c
SHA256

cfffbc8a94c9a1cca06a53b6bf460932eed69de24c4bbc5251805f076f651418
SHA512

fbee3dad164a4659f9559a5cdd3e7d37b3f54ae85ce20dc13907b96d2a44c2272544e3a1d179ace0e13d5945a9099ea302368a7af4ae99d09f4ed2f536f8ee77
SSDEEP

3072:uyc16FoeGMILLBRsA7zFzkzTUzBW7YWH1z:rcB7tBk3L

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1256	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1256	2032	rundll32.exe	16
PID 2032 wrote to memory of 1256	2032	rundll32.exe	16
PID 2032 wrote to memory of 1256	2032	rundll32.exe	16
PID 2032 wrote to memory of 1256	2032	rundll32.exe	16
PID 2032 wrote to memory of 1256	2032	rundll32.exe	16
PID 2032 wrote to memory of 1256	2032	rundll32.exe	16
PID 2032 wrote to memory of 1256	2032	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\02e2841d7b2d7ed666ef16022fce8eba.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\02e2841d7b2d7ed666ef16022fce8eba.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-3-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download
memory/1256-2-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download
memory/1256-1-0x0000000002100000-0x0000000002226000-memory.dmp

Filesize
1.1MB

Download
memory/1256-0-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download