61232546a12b4ef6007cb3637f41ed973dce5e18412e92af3c2d88ee8f0ed9eb | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 17:47

Sharing

Report Analysis Logs

General

Target

440d403513e8d133f0cdea1f74e5f93c.dll
Size

124KB
MD5

440d403513e8d133f0cdea1f74e5f93c
SHA1

985b396bcac7f9ad3ba41e609864096e56cc88b8
SHA256

61232546a12b4ef6007cb3637f41ed973dce5e18412e92af3c2d88ee8f0ed9eb
SHA512

af9830eda3669fc3338bfed5cdb5ed4b4a7acc8d8c32b7a0e3a894e4e34057c9ee27296f9e014f2d7eaafe17b65c68f72e65725b98066bb5e536e1be72d6d202
SSDEEP

1536:42XZSXvAoOnr8lwDNGr1vHO96A+Vyv3uSEOL:bS/Avr/5GZvjTVyv3uSEO

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2316	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2316	2500	rundll32.exe	28
PID 2500 wrote to memory of 2316	2500	rundll32.exe	28
PID 2500 wrote to memory of 2316	2500	rundll32.exe	28
PID 2500 wrote to memory of 2316	2500	rundll32.exe	28
PID 2500 wrote to memory of 2316	2500	rundll32.exe	28
PID 2500 wrote to memory of 2316	2500	rundll32.exe	28
PID 2500 wrote to memory of 2316	2500	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\440d403513e8d133f0cdea1f74e5f93c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\440d403513e8d133f0cdea1f74e5f93c.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads