e8582220f161aef10bcba30369f4d9a3f2a53024b9cd4a5f9f9fecfb98ba8be2 | Triage

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:12

Sharing

Report Analysis Logs

General

Target

WindowBlinds/clock.dll
Size

7KB
MD5

55006ed14230a5d4c3c6a3f12522e9d2
SHA1

5682f96b5e1bc03b9a45a562a41b15c1ec401cfd
SHA256

e069b7969005fc16e197e1a61b42c01a3f356ccea8f2de208df0108997e22bb2
SHA512

f2bc54b1d3f532e2d67a75277ea061695554b0daa8ba75b415c10609a8c8eb34cd06b0f0e5ea7ad8124767eee2f21444610ad756feea614f6235629a4e50a9fd
SSDEEP

96:Z9JqRoyWNt702+UhQ8i3Bbhd1JgDa843nbjka:Z/qRoDNx0u68SBbrwDaTnbT

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2840	2852	rundll32.exe	27
PID 2852 wrote to memory of 2840	2852	rundll32.exe	27
PID 2852 wrote to memory of 2840	2852	rundll32.exe	27
PID 2852 wrote to memory of 2840	2852	rundll32.exe	27
PID 2852 wrote to memory of 2840	2852	rundll32.exe	27
PID 2852 wrote to memory of 2840	2852	rundll32.exe	27
PID 2852 wrote to memory of 2840	2852	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowBlinds\clock.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowBlinds\clock.dll,#1
  2⤵
  PID:2840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads