73f377da98d182d21658995b07702384c55ec4c4d1df025dbeaaa522c184e194 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/01/2024, 15:47

Sharing

Report Analysis Logs

General

Target

3e5fe7ca3968f28037f81a535536cc79.dll
Size

40KB
MD5

3e5fe7ca3968f28037f81a535536cc79
SHA1

32ca7f96378b6d71af63dba6dea16b86574141a6
SHA256

73f377da98d182d21658995b07702384c55ec4c4d1df025dbeaaa522c184e194
SHA512

cab15fcacb276f2270c73c1233e37c8c62b2d7622c26e7a170ef11a564d29efa8cc337b2a7cd0f457d0dfb83b8886d2d11a8ee42cbd34e798bb5b97bf3f1326c
SSDEEP

768:FuLt3s2H/Dy/BlO2FxpIxa9o68n4fqMuz:FuJ3drq1XpIxaR8kqMuz

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2128	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2128	2428	rundll32.exe	28
PID 2428 wrote to memory of 2128	2428	rundll32.exe	28
PID 2428 wrote to memory of 2128	2428	rundll32.exe	28
PID 2428 wrote to memory of 2128	2428	rundll32.exe	28
PID 2428 wrote to memory of 2128	2428	rundll32.exe	28
PID 2428 wrote to memory of 2128	2428	rundll32.exe	28
PID 2428 wrote to memory of 2128	2428	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e5fe7ca3968f28037f81a535536cc79.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e5fe7ca3968f28037f81a535536cc79.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads