dbf53c46f6df2246d4651af03f9a569b28fbf553e950f155cd41cfa002861e56 | Triage

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 22:20

Sharing

Report Analysis Logs

General

Target

a07b039e14dbe38fec8552d0cf72cafe.dll
Size

48KB
MD5

a07b039e14dbe38fec8552d0cf72cafe
SHA1

2420fc972072076e2c8d9ce0eb8e21906c2ea0d8
SHA256

dbf53c46f6df2246d4651af03f9a569b28fbf553e950f155cd41cfa002861e56
SHA512

7168e7b5e912e3c42ca19319b243f8088974d1bc40a75a736a39fee5ecb3615cd79f1936477dda568eac34fcf832761b862bfa57185e4f8bd2bc9a4c5a3d65e2
SSDEEP

768:IBDm7Lyc2WQ4zMVroiTyt6sfYIJ+9lfmL0:IBDmP3zRiTyt6sfY7l+L0

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2016	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2016	1724	rundll32.exe	28
PID 1724 wrote to memory of 2016	1724	rundll32.exe	28
PID 1724 wrote to memory of 2016	1724	rundll32.exe	28
PID 1724 wrote to memory of 2016	1724	rundll32.exe	28
PID 1724 wrote to memory of 2016	1724	rundll32.exe	28
PID 1724 wrote to memory of 2016	1724	rundll32.exe	28
PID 1724 wrote to memory of 2016	1724	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a07b039e14dbe38fec8552d0cf72cafe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a07b039e14dbe38fec8552d0cf72cafe.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads