6c02318ae65496c8b178affa6cce80a195fd5c4c9c46e8f0f93fcfa252ba49cb | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:00

Sharing

Report Analysis Logs

General

Target

ImeHook.dll
Size

16KB
MD5

deded28d23751c4aa242dc1a4536528f
SHA1

3de9f1d13bf371ae2a1a64ce3f7ffc68cdf227c9
SHA256

165886f070a708d72cf6bad5ca03aae4a866df5d2dbde33d28f6363e3667ecc7
SHA512

ed76c347feee85c812095fb2ed44a4be7d3a941e1d7b7acff883bb2f8f20fb79454479016cea276b0f163b22e75236eb9f8e808dad11f67b9be1ecacc149107b
SSDEEP

384:zqIiqiqTxtKyegtVsilJJur5Jsq8ILKOLLvYiDsssjVPa5:ZizqFtxeosQJ8r3sFkL7sv6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2040	2180	rundll32.exe	28
PID 2180 wrote to memory of 2040	2180	rundll32.exe	28
PID 2180 wrote to memory of 2040	2180	rundll32.exe	28
PID 2180 wrote to memory of 2040	2180	rundll32.exe	28
PID 2180 wrote to memory of 2040	2180	rundll32.exe	28
PID 2180 wrote to memory of 2040	2180	rundll32.exe	28
PID 2180 wrote to memory of 2040	2180	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ImeHook.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ImeHook.dll,#1
  2⤵
  PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads