6c02318ae65496c8b178affa6cce80a195fd5c4c9c46e8f0f93fcfa252ba49cb | Triage

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:00

Sharing

Report Analysis Logs

General

Target

ImeHook.dll
Size

17KB
MD5

927e34571447f7fd8a0722825065afc9
SHA1

9cf382cf0bf6330d10e391ac32172fc3be172e7d
SHA256

2e985d65f32d3918107a7b253aee42e211ae602b83689beb75cf771a89e07736
SHA512

9340b54f02ad7bd21b531036e99397a3300db7b9c7eadd29630298efaf906a99a4d63a93ba5a6919316bf4b86480b2291ae77e8249fc7b57e0a3c97023fffa92
SSDEEP

384:Vj0DebCk4b2igrcf18zlJmoGuO8Irq2lwmOLLvYiDsssjVnx:ubkfiqJm4h2lwfL7svx

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 3012	2992	rundll32.exe	16
PID 2992 wrote to memory of 3012	2992	rundll32.exe	16
PID 2992 wrote to memory of 3012	2992	rundll32.exe	16
PID 2992 wrote to memory of 3012	2992	rundll32.exe	16
PID 2992 wrote to memory of 3012	2992	rundll32.exe	16
PID 2992 wrote to memory of 3012	2992	rundll32.exe	16
PID 2992 wrote to memory of 3012	2992	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ImeHook.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ImeHook.dll,#1
  2⤵
  PID:3012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads