4cf08910588f7fd1f1c9e778c993274be53f703d7e87b176878e52671a19dc09 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 05:07

Sharing

Report Analysis Logs

General

Target

HookXC.dll
Size

616KB
MD5

eb25ea5a0bbc5fc59133075980b6e76e
SHA1

9af3f4ce6d75831121f871b362516dcc79109730
SHA256

f501c9bf6d77d40554cbfc0487cb76628b20b05b412da9a03638028a79b86648
SHA512

f6c9e63d966a8d76207b0b23fc241669a64ba4db852155a98b940c864890d9ff3d72a8439ec501ef84512d6defb51ece13547fe200d68799aea933a25adf7675
SSDEEP

12288:VUdZSC9vse0BWzwRA5Dw8rRUNlybnHr0fE8/pDZ8ckaW:VmSCPtRUNw7r0fZeP

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
952	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
952	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 952	1328	rundll32.exe	14
PID 1328 wrote to memory of 952	1328	rundll32.exe	14
PID 1328 wrote to memory of 952	1328	rundll32.exe	14
PID 1328 wrote to memory of 952	1328	rundll32.exe	14
PID 1328 wrote to memory of 952	1328	rundll32.exe	14
PID 1328 wrote to memory of 952	1328	rundll32.exe	14
PID 1328 wrote to memory of 952	1328	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HookXC.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:952

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HookXC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/952-1-0x0000000010000000-0x000000001022B000-memory.dmp

Filesize
2.2MB

Download
memory/952-0-0x0000000010000000-0x000000001022B000-memory.dmp

Filesize
2.2MB

Download