307f434bc2388b368d5d9001c322ac640c2a3e69b29b421f68ff57b8ac60106c | Triage

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 18:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

00fec8d99d6b58175708a31d96aa2285.dll
Size

20KB
MD5

00fec8d99d6b58175708a31d96aa2285
SHA1

9d81bb281975a5c62175250557984218df4a3e27
SHA256

307f434bc2388b368d5d9001c322ac640c2a3e69b29b421f68ff57b8ac60106c
SHA512

1a73fbe87cb6b20f31767dd0bb6623b390dc7e0f86d9953a23248d390c63aae2c74705452ef8358e51496c742e4aac69b6c8a15587dccde0538ace4f3cc4bdff
SSDEEP

384:5RdCyDzMqlWemQiCdwlU84i+okeRg3HCeXAz+EKO:RCysql/mQpzi+o9RkHs+

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1984	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 1984	1856	rundll32.exe	83
PID 1856 wrote to memory of 1984	1856	rundll32.exe	83
PID 1856 wrote to memory of 1984	1856	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00fec8d99d6b58175708a31d96aa2285.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\00fec8d99d6b58175708a31d96aa2285.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads