22bee3a6772b5efcc68763426ba509f8e852e94bdf870e713611004ae75dbb6a | Triage

Analysis

max time kernel
153s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2024, 13:42

Sharing

Report Analysis Logs

General

Target

3eaeb764ba21a207fda3df6f3281b628.dll
Size

231KB
MD5

3eaeb764ba21a207fda3df6f3281b628
SHA1

6ade198a2b944af228b4c394945fb881fe267950
SHA256

22bee3a6772b5efcc68763426ba509f8e852e94bdf870e713611004ae75dbb6a
SHA512

b6cd64e0998a85c4c1ac113e4895c2cf2da0ced90bf40d54011577d98423537cc6095ee6504987d91088e8e4ad1146ceebe2394116fb482071a7d6b9078d3998
SSDEEP

6144:MfzP1REI0kwkxZnoa/qgjoABmkyhVZ0XOmAuhzsuh8a:uzPMiNonn/0XauGu

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3216	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 3216	4288	rundll32.exe	84
PID 4288 wrote to memory of 3216	4288	rundll32.exe	84
PID 4288 wrote to memory of 3216	4288	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3eaeb764ba21a207fda3df6f3281b628.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3eaeb764ba21a207fda3df6f3281b628.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3216-0-0x0000000010000000-0x000000001011C000-memory.dmp

Filesize
1.1MB

Download