22eb1885bead5bc5fd98846ed1d8cf95c9da0dc7a711d60aacb98cb987b974a7 | Triage

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 08:53

Sharing

Report Analysis Logs

General

Target

13d04f2881febedcfc54ef4869a85eef.dll
Size

28KB
MD5

13d04f2881febedcfc54ef4869a85eef
SHA1

8bd5f654a4cb237e3c2ed58fcce4858246d96246
SHA256

22eb1885bead5bc5fd98846ed1d8cf95c9da0dc7a711d60aacb98cb987b974a7
SHA512

846f31518be9c113f198c5df1890228ef6b688892f43efd4cc0c69bcc6d670fac115c993216cb2e65aac27c4c001ac32bf259ba991a1deed3a75340c6f2a13fd
SSDEEP

768:/0wmeBNLFKpueH7LFRSDuhRBxPXn64AZE:bm8pI9EmRBxVAZE

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2512	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2512	2508	rundll32.exe	28
PID 2508 wrote to memory of 2512	2508	rundll32.exe	28
PID 2508 wrote to memory of 2512	2508	rundll32.exe	28
PID 2508 wrote to memory of 2512	2508	rundll32.exe	28
PID 2508 wrote to memory of 2512	2508	rundll32.exe	28
PID 2508 wrote to memory of 2512	2508	rundll32.exe	28
PID 2508 wrote to memory of 2512	2508	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13d04f2881febedcfc54ef4869a85eef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\13d04f2881febedcfc54ef4869a85eef.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads