3cc2024704d4ce687c29ebdb307b3bd69ae23087a5cec282eec53a49150272b7 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:24

Sharing

Report Analysis Logs

General

Target

2646a9061a05a4947033a276c13d38e5.dll
Size

118KB
MD5

2646a9061a05a4947033a276c13d38e5
SHA1

c6620ddf9d9951dfd184b3aafb1a5971f80fff16
SHA256

3cc2024704d4ce687c29ebdb307b3bd69ae23087a5cec282eec53a49150272b7
SHA512

ee8d70b4dde347990783f987156389d604b469b54f211e686f34ca5f600ceb441015711d893b943a894fb9f7bc9fb6adf84aaad47ff57774677b122be49a2354
SSDEEP

1536:DCDGL+3qHECyzftwZAxadGgYi9+ftnzFgLZOq:eqmzFTXi8Fnzg

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2404	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2404	2124	rundll32.exe	28
PID 2124 wrote to memory of 2404	2124	rundll32.exe	28
PID 2124 wrote to memory of 2404	2124	rundll32.exe	28
PID 2124 wrote to memory of 2404	2124	rundll32.exe	28
PID 2124 wrote to memory of 2404	2124	rundll32.exe	28
PID 2124 wrote to memory of 2404	2124	rundll32.exe	28
PID 2124 wrote to memory of 2404	2124	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2646a9061a05a4947033a276c13d38e5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2646a9061a05a4947033a276c13d38e5.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads