2265cc795e1783d692997be92f7f99ebc9a3a6f2253c109bf524308e1e5a0b5f | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 10:34

Sharing

Report Analysis Logs

General

Target

1788508847bafb5a440bc4bb613438f2.dll
Size

30KB
MD5

1788508847bafb5a440bc4bb613438f2
SHA1

7de625158806d9a6058e9707a476ddecda61f737
SHA256

2265cc795e1783d692997be92f7f99ebc9a3a6f2253c109bf524308e1e5a0b5f
SHA512

bc8dbe39ca34cb08a5c39bf23a4181a1f388d983f3fcb45020b2db6d11571e1c98479c25a0617aaa3c1acfa4fcdafe61ac6a12dd4462df98d713d9e940a93e1c
SSDEEP

768:q0sBRCTKpRV1lZxBfdtMANlMTmbczkLUv:qrRNRVz3B1NlMTmQzY2

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2800	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2800	2904	rundll32.exe	14
PID 2904 wrote to memory of 2800	2904	rundll32.exe	14
PID 2904 wrote to memory of 2800	2904	rundll32.exe	14
PID 2904 wrote to memory of 2800	2904	rundll32.exe	14
PID 2904 wrote to memory of 2800	2904	rundll32.exe	14
PID 2904 wrote to memory of 2800	2904	rundll32.exe	14
PID 2904 wrote to memory of 2800	2904	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1788508847bafb5a440bc4bb613438f2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1788508847bafb5a440bc4bb613438f2.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads