8fc6add96f8874a78b332688f055f44e5ef2b8d753de81bd767505810099ee64 | Triage

Analysis

max time kernel
92s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18-01-2024 18:20

Sharing

Report Analysis Logs

General

Target

65b5d9f8320ad7fb0c396d4567ebb765.dll
Size

50KB
MD5

65b5d9f8320ad7fb0c396d4567ebb765
SHA1

de5d510838f1655b15459e0bdf9a35a9b68533de
SHA256

8fc6add96f8874a78b332688f055f44e5ef2b8d753de81bd767505810099ee64
SHA512

03a913342239a436212e62ac35a1542a5f129a5627c176659cc2241a84351d95e610f07ea902414b4da9fe873ee60b0378823d3e7e0155ad89fbb919d267db6f
SSDEEP

1536:Fg84Es7igOTorMd8lHnEmfntE9WBcOokrqfMIaIPCA:m8xoigeQLaLRsFFIPt

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2000	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 2000	3784	rundll32.exe	25
PID 3784 wrote to memory of 2000	3784	rundll32.exe	25
PID 3784 wrote to memory of 2000	3784	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65b5d9f8320ad7fb0c396d4567ebb765.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\65b5d9f8320ad7fb0c396d4567ebb765.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-0-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/2000-1-0x0000000000C20000-0x0000000000C25000-memory.dmp

Filesize
20KB

Download
memory/2000-2-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/2000-3-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download