42a08a6fcf768016668be7f5eb36d300a91b071c2fed9a128a066f3e7f2d53e0 | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2024 01:10

Sharing

Report Analysis Logs

General

Target

ba2382cedba6dddd89bfe8fac320f752.dll
Size

708KB
MD5

ba2382cedba6dddd89bfe8fac320f752
SHA1

8c9491dc4c924b34fffa887c7dff65086bc1c277
SHA256

42a08a6fcf768016668be7f5eb36d300a91b071c2fed9a128a066f3e7f2d53e0
SHA512

31bb8a7f82debd58dd28d18c5a7d34ebf2dcf22e2d402f2f683af4d150ee1306681c365acd4a84885664ec89fc34f6b1700ebe75896defdd92f0d996a58899f9
SSDEEP

12288:3BlQSxwZ+OcrezjTo6jN8ioUdLZATQwi:3PTxe9coR8RmLeli

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2528	rundll32.exe
2528	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 2528	3660	rundll32.exe	89
PID 3660 wrote to memory of 2528	3660	rundll32.exe	89
PID 3660 wrote to memory of 2528	3660	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba2382cedba6dddd89bfe8fac320f752.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba2382cedba6dddd89bfe8fac320f752.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2528-0-0x0000000012040000-0x0000000012105000-memory.dmp

Filesize
788KB

Download
memory/2528-1-0x0000000012040000-0x0000000012105000-memory.dmp

Filesize
788KB

Download