e6ff0b90662e2720c18345c30722ee6128c27dcc85acee4d8ee9c785b9bc44ff | Triage

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24-02-2024 10:32

Sharing

Report Analysis Logs

General

Target

hrk.dll
Size

1.6MB
MD5

8e3ebe121097210f1e630ed01436ddef
SHA1

f21c9b8be299bc136e07d5f127d59869d5ffacd0
SHA256

48a748acf18f8c01e0b1f39af47d49dcdf4762bf0de873bdb156eb2e5d7e24b2
SHA512

3de9c26d8c78d568e4a08dd1a0dfd69f579657d1895e3cb69e20e714d2d05bf7bb6c02bd24994da1257a4d8b3d08b226c30dd017849e986d329aa65b9b67221b
SSDEEP

49152:EAaEMaCRxowAQTVYACGdN3Vu9VP1QCgBzHAom2/O3DAKxVTvkBnJ:tMaCbowAyV6GdN349VP1QCgxHI2/O3Mn

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5072	rundll32.exe
5072	rundll32.exe
5072	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 5072	2344	rundll32.exe	85
PID 2344 wrote to memory of 5072	2344	rundll32.exe	85
PID 2344 wrote to memory of 5072	2344	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hrk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\hrk.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads