125345eb6fb6ad9d94555f3180dd27179bd72802ffae647f2209aa3f22597e5a | Triage

Analysis

max time kernel
119s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 12:55

Sharing

Report Analysis Logs

General

Target

192c3abba3c95d01a51e21df1038421b.dll
Size

31KB
MD5

192c3abba3c95d01a51e21df1038421b
SHA1

2c25e1aa0cb3cffd83466c19541c266c3991cbd7
SHA256

125345eb6fb6ad9d94555f3180dd27179bd72802ffae647f2209aa3f22597e5a
SHA512

8a928d8b41222ead702cceb09715c9ac972d873bc421765da4234ebf96d5080d41333758cba97405a282f66bd8b52f95906d15e7ae7b25077cb55348dcea03ce
SSDEEP

768:oUQaW69MIUSNEy1zQAgcnl6motMgNtb1uDi2:JNXJEyVBl4NtcDn

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1276	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 1276	2632	rundll32.exe	28
PID 2632 wrote to memory of 1276	2632	rundll32.exe	28
PID 2632 wrote to memory of 1276	2632	rundll32.exe	28
PID 2632 wrote to memory of 1276	2632	rundll32.exe	28
PID 2632 wrote to memory of 1276	2632	rundll32.exe	28
PID 2632 wrote to memory of 1276	2632	rundll32.exe	28
PID 2632 wrote to memory of 1276	2632	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\192c3abba3c95d01a51e21df1038421b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\192c3abba3c95d01a51e21df1038421b.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads