b2dc199bb25741d4d5ab2f72ea7c3abed350a60136da2da2ee7d8264bd773186 | Triage

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 05:40

Sharing

Report Analysis Logs

General

Target

2a65edccf04a32bd04ec1c0208019999.dll
Size

101KB
MD5

2a65edccf04a32bd04ec1c0208019999
SHA1

847e4ff5fdec5278d8217c108511ca9909ef1b63
SHA256

b2dc199bb25741d4d5ab2f72ea7c3abed350a60136da2da2ee7d8264bd773186
SHA512

8446fcb7c56fa48cd140ec31745da0c6dabf8e0941835b9c065264d79b0d74ac90012ab1a05d6dacb484868d4f0f38900d2139c87a4d1069bea7289231fedd54
SSDEEP

3072:IDwV3fYOCWU5vgLl4537jvAwf8Hpv4Fdn:IQvKz5My53vvAwf8Obn

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3984	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 3984	2192	rundll32.exe	16
PID 2192 wrote to memory of 3984	2192	rundll32.exe	16
PID 2192 wrote to memory of 3984	2192	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a65edccf04a32bd04ec1c0208019999.dll,#1
1⤵
- Suspicious use of SetWindowsHookEx
PID:3984

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a65edccf04a32bd04ec1c0208019999.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3984-1-0x0000000001130000-0x0000000001136000-memory.dmp

Filesize
24KB

Download
memory/3984-0-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download
memory/3984-2-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download
memory/3984-4-0x0000000001130000-0x0000000001136000-memory.dmp

Filesize
24KB

Download