2ea1e8b74e1e3423ce83ba33738bb3d7c7723034f7169ec4f22d00997276fa05 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 01:45

Sharing

Report Analysis Logs

General

Target

0a8bd5d01a6af270d855154fcbcee2dd.dll
Size

40KB
MD5

0a8bd5d01a6af270d855154fcbcee2dd
SHA1

f804dc36437c662e9438aeff83bf425d63c9aa45
SHA256

2ea1e8b74e1e3423ce83ba33738bb3d7c7723034f7169ec4f22d00997276fa05
SHA512

fd2d001867d81dd2a054daad5888119c5491b2ccf948e602c3aa0fcb5e9161f64abf0e3d0c321d2c16181e63e79312608a20a76fb686c97b215aef4a72405c5b
SSDEEP

768:hAHiGDd/GSUs5yOAdtW6cwcxhk0TOT3vAUlYLc:hYscy1FcxhknvAIIc

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2960	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 2960	1576	rundll32.exe	10
PID 1576 wrote to memory of 2960	1576	rundll32.exe	10
PID 1576 wrote to memory of 2960	1576	rundll32.exe	10
PID 1576 wrote to memory of 2960	1576	rundll32.exe	10
PID 1576 wrote to memory of 2960	1576	rundll32.exe	10
PID 1576 wrote to memory of 2960	1576	rundll32.exe	10
PID 1576 wrote to memory of 2960	1576	rundll32.exe	10

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a8bd5d01a6af270d855154fcbcee2dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a8bd5d01a6af270d855154fcbcee2dd.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads