61232546a12b4ef6007cb3637f41ed973dce5e18412e92af3c2d88ee8f0ed9eb | Triage

Analysis

max time kernel
139s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2024 17:47

Sharing

Report Analysis Logs

General

Target

440d403513e8d133f0cdea1f74e5f93c.dll
Size

124KB
MD5

440d403513e8d133f0cdea1f74e5f93c
SHA1

985b396bcac7f9ad3ba41e609864096e56cc88b8
SHA256

61232546a12b4ef6007cb3637f41ed973dce5e18412e92af3c2d88ee8f0ed9eb
SHA512

af9830eda3669fc3338bfed5cdb5ed4b4a7acc8d8c32b7a0e3a894e4e34057c9ee27296f9e014f2d7eaafe17b65c68f72e65725b98066bb5e536e1be72d6d202
SSDEEP

1536:42XZSXvAoOnr8lwDNGr1vHO96A+Vyv3uSEOL:bS/Avr/5GZvjTVyv3uSEO

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1596	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 1596	1248	rundll32.exe	90
PID 1248 wrote to memory of 1596	1248	rundll32.exe	90
PID 1248 wrote to memory of 1596	1248	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\440d403513e8d133f0cdea1f74e5f93c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\440d403513e8d133f0cdea1f74e5f93c.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads