887c411c9f2d4aeb2e6248fd33c0f8737c94cca669b3e1fb7ed2baeaeb07ea58 | Triage

Analysis

max time kernel
142s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 06:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

55ba468821c51846cd7f7128410e5d42.dll
Size

5KB
MD5

55ba468821c51846cd7f7128410e5d42
SHA1

f70ae9609e95821a697a320adbdb2bb91bd63ee9
SHA256

887c411c9f2d4aeb2e6248fd33c0f8737c94cca669b3e1fb7ed2baeaeb07ea58
SHA512

81812c19a3f7461968f8ac12d3cc5fb0137ff0bfc450234f2fa0e44454611685a5536d9bc2b7ebe08084d166c9c09f77db2dc7fbeba6ac954e5e9aea1738f793
SSDEEP

96:Z1jZk1VcHK9Cc5Unb3tolhjnlcxLWgwv:m1Vcq9Cc583ClhJ8I

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5068	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 5068	3276	rundll32.exe	89
PID 3276 wrote to memory of 5068	3276	rundll32.exe	89
PID 3276 wrote to memory of 5068	3276	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55ba468821c51846cd7f7128410e5d42.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\55ba468821c51846cd7f7128410e5d42.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5068-0-0x00000000008C0000-0x00000000008C5000-memory.dmp

Filesize
20KB

Download