c27b4cfc3eeafbac10fceb4ccece9eb702bbc83f95868e2d265c3b3e938dea79 | Triage

Analysis

max time kernel
190s
max time network
298s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
11-03-2024 14:56

Sharing

Report Analysis Logs

General

Target

napalm_hook.dll
Size

341KB
MD5

e2a68ccb323d103034a0ba6deb9ae1c5
SHA1

c6137d88d67469cf80a15caf65b779e2249ad9d4
SHA256

00151dbec59f369a280112d04b1ed3202323eaa8c487d9da6deba67bf7c89237
SHA512

d92d1b25e598f7a7b956a655e4d6d2a344b0bff517ce650521ecbaffb730314ef2f82ac04842ebdb5f60d49c3a449a5db44bb7d647fc1a9869eec4cd31a00eab
SSDEEP

6144:57oy9Zr+BAF84IC117bTyQdgrmPCeQelz7lWLxnNSdwl2OSd2T:iy9Zrp8smcYmEAexnNb

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2572	rundll32.exe
2572	rundll32.exe
2572	rundll32.exe
2572	rundll32.exe
2572	rundll32.exe
2572	rundll32.exe
2572	rundll32.exe
2572	rundll32.exe
2572	rundll32.exe
2572	rundll32.exe
2572	rundll32.exe
2572	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2572	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\napalm_hook.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads