8e1006e5f230f269bb9ce80e5c2b7f3b930cb68f3d975697d45b4e4bae33ce58 | Triage

Analysis

max time kernel
118s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 00:16

Sharing

Report Analysis Logs

General

Target

getword/GetWordDemo/ICall.dll
Size

296KB
MD5

5afe274909bc4fe3fa47c94e8efad7d6
SHA1

c72f79d0f12c10f29b0c4863b892d309810c011c
SHA256

fec968f4d9915e86ad27ac6066eddba21ce8c288552e14c528a91035c43da986
SHA512

155bc0af92995763c538b8cadced32c7d4853a6f3483c2205522bb12c14673889f581504fb00f68c917edd4f37fa10501bbd904bbe041e36a334704b88ae9cc6
SSDEEP

6144:T8VVwdPLemV7aErviSxjA5moMpKqvFhLfjE:qVaPamRtjANwKGFF

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2340	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2340	2892	rundll32.exe	29
PID 2892 wrote to memory of 2340	2892	rundll32.exe	29
PID 2892 wrote to memory of 2340	2892	rundll32.exe	29
PID 2892 wrote to memory of 2340	2892	rundll32.exe	29
PID 2892 wrote to memory of 2340	2892	rundll32.exe	29
PID 2892 wrote to memory of 2340	2892	rundll32.exe	29
PID 2892 wrote to memory of 2340	2892	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\getword\GetWordDemo\ICall.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\getword\GetWordDemo\ICall.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2340-0-0x0000000000770000-0x0000000000794000-memory.dmp

Filesize
144KB

Download