5030411598c96aa76a73f13ee1def8f54e3cd7ef5b2166f134dcf1e2a9fc1de2 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 04:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

98721104cb56b938f859fe98cf0d941f.dll
Size

50KB
MD5

98721104cb56b938f859fe98cf0d941f
SHA1

b3727036138f9e06ac01b18b1c97ea2ddebf2f6f
SHA256

5030411598c96aa76a73f13ee1def8f54e3cd7ef5b2166f134dcf1e2a9fc1de2
SHA512

fc734303131ee2bbf3056352d1a72551811c64a87bf1aa3715ca685cdad05a5acdc9b33febf4cb0b2f99331ce7c8fc5bbe3404e57959c57e5236ae3f88cc854e
SSDEEP

1536:e3g/+akopbdyOPCB53gxfL28pt6aK3oAaee:ew/+akop6BKxfL28pt6loAE

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\fudusomu.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\fadiyiwo	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1556	rundll32.exe
1556	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1556	2008	rundll32.exe	14
PID 2008 wrote to memory of 1556	2008	rundll32.exe	14
PID 2008 wrote to memory of 1556	2008	rundll32.exe	14
PID 2008 wrote to memory of 1556	2008	rundll32.exe	14
PID 2008 wrote to memory of 1556	2008	rundll32.exe	14
PID 2008 wrote to memory of 1556	2008	rundll32.exe	14
PID 2008 wrote to memory of 1556	2008	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\98721104cb56b938f859fe98cf0d941f.dll,#1
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1556

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\98721104cb56b938f859fe98cf0d941f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1556-1-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/1556-0-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/1556-2-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download