521167e88c22ee20abe86c123a5c46a32166ab44e15cdba39a45d98d6c929181 | Triage

Analysis

max time kernel
93s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 18:11

Sharing

Report Analysis Logs

General

Target

337e1936e5b50b2e621fcfcde7991fb3.dll
Size

96KB
MD5

337e1936e5b50b2e621fcfcde7991fb3
SHA1

3b0129f8ec8fb118ac7fcb3ed3958078368c5104
SHA256

521167e88c22ee20abe86c123a5c46a32166ab44e15cdba39a45d98d6c929181
SHA512

d4a675a2989341cc0fdef5cb3f008fe0eebb5f78a9a08ffb48ed4c8b24bf101dc1f414e52c3181ccf58cec931133e7f6ccd78f5b3c2deb220af2efe3e97989e2
SSDEEP

3072:sxqwssvJvZNRJCYnYvLuIU2qu0747Rhu5Wt8:HwsshvZNRgYny1U747R07

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4492	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 4492	3864	rundll32.exe	14
PID 3864 wrote to memory of 4492	3864	rundll32.exe	14
PID 3864 wrote to memory of 4492	3864	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\337e1936e5b50b2e621fcfcde7991fb3.dll,#1
1⤵
- Suspicious use of SetWindowsHookEx
PID:4492

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\337e1936e5b50b2e621fcfcde7991fb3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4492-1-0x0000000000FE0000-0x0000000000FF2000-memory.dmp

Filesize
72KB

Download
memory/4492-3-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/4492-2-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/4492-0-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download