e07098559756a0a85f622ef0a93f3f3fe264dc9718a299c57f0491128f96219e | Triage

Analysis

max time kernel
133s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 22:39

Sharing

Report Analysis Logs

General

Target

05db7955d32ee1f0e5c7ec715ec07512.dll
Size

929KB
MD5

05db7955d32ee1f0e5c7ec715ec07512
SHA1

a8bd409a8c523860b053092c7624497932ad7adf
SHA256

e07098559756a0a85f622ef0a93f3f3fe264dc9718a299c57f0491128f96219e
SHA512

2435a95b9a58a984b4ff0b445f881e7b1206c304adea020b0f32de78ae43a225d8d2a89bcf4e609fad5d758d419d342cd1f8dd288d83ff018a38fdd4bd3a0a22
SSDEEP

24576:Bn+byEFtcjNtscfpFVp7pdNWJqk+m7WbMi:V+7FiB+cfRWkkjA

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4212	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 4212	1600	rundll32.exe	14
PID 1600 wrote to memory of 4212	1600	rundll32.exe	14
PID 1600 wrote to memory of 4212	1600	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05db7955d32ee1f0e5c7ec715ec07512.dll,#1
1⤵
- Suspicious use of SetWindowsHookEx
PID:4212

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05db7955d32ee1f0e5c7ec715ec07512.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads