12dac64d1fda5b640c8a33014b43fff0bae1feb0775c5ba1363dc3b6abee1129 | Triage

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 09:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

654882a7d7fe56e9ec9a65e482deef37.dll
Size

31KB
MD5

654882a7d7fe56e9ec9a65e482deef37
SHA1

f1f4fb257550c767f2534d4d411f10ab2c4afece
SHA256

12dac64d1fda5b640c8a33014b43fff0bae1feb0775c5ba1363dc3b6abee1129
SHA512

a9349aefb483f765691190b13ee5c0bb0983ae2f9e7fae1e19a206db662a2e96c88d85937a10144e238682ce9eb15affbf2750744228e23d464fbbbc89755591
SSDEEP

768:ojfKGXNgSN0i1zJn25w6GtMgNtUCsIJzf:Kig0i1x2mNtTvzf

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2192	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2192	1736	rundll32.exe	14
PID 1736 wrote to memory of 2192	1736	rundll32.exe	14
PID 1736 wrote to memory of 2192	1736	rundll32.exe	14
PID 1736 wrote to memory of 2192	1736	rundll32.exe	14
PID 1736 wrote to memory of 2192	1736	rundll32.exe	14
PID 1736 wrote to memory of 2192	1736	rundll32.exe	14
PID 1736 wrote to memory of 2192	1736	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\654882a7d7fe56e9ec9a65e482deef37.dll,#1
1⤵
- Suspicious use of SetWindowsHookEx
PID:2192

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\654882a7d7fe56e9ec9a65e482deef37.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads