9cf1fac3b70c572fa6c3edbfe16561bef310e94cd8381df18853c2a8ac9eacab | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 13:44

Sharing

Report Analysis Logs

General

Target

keycf.dll
Size

204KB
MD5

29dbe94291be71a89545c7b3c5d3f79c
SHA1

dea86ab08bf114eae47a4c091c0dba4cd199010f
SHA256

1d09895873f8d4d2b5ea018c2d42a1384dfe0c5b4c8d914e37733bb64e35bc65
SHA512

4ed9824e72d9479d2a5cf1c865a4e92e8cf73e60a8d87950ded2b41e26c93811a3c2880c3bf07c0dc007af9fe43673ef0f399d5c9c9b16ec85f8a2f02095ec9a
SSDEEP

3072:D3unGHHVNpTLKQTwk/2M8rmDSH3ubVExighVQp+/FmUGoBR+LTRjmUmc57Qi:D1HHBnHL2MKxHsVinVQp+/Fcaefe

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2912	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2912	1700	rundll32.exe	28
PID 1700 wrote to memory of 2912	1700	rundll32.exe	28
PID 1700 wrote to memory of 2912	1700	rundll32.exe	28
PID 1700 wrote to memory of 2912	1700	rundll32.exe	28
PID 1700 wrote to memory of 2912	1700	rundll32.exe	28
PID 1700 wrote to memory of 2912	1700	rundll32.exe	28
PID 1700 wrote to memory of 2912	1700	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\keycf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\keycf.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2912-1-0x0000000010000000-0x0000000010074000-memory.dmp

Filesize
464KB

Download
memory/2912-0-0x0000000010000000-0x0000000010074000-memory.dmp

Filesize
464KB

Download
memory/2912-4-0x0000000010000000-0x0000000010074000-memory.dmp

Filesize
464KB

Download