3bf326a78ee4b72f960ed90ca0a2f119672e44c736d4bafb16c9759d71f73b1b | Triage

Analysis

max time kernel
146s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 07:01

Sharing

Report Analysis Logs

General

Target

屏幕录像专家V60/Hook1.dll
Size

32KB
MD5

955f45d4a1af66785b832b95fb99a06d
SHA1

f38350d877cc06f6005aff733d6437a07f89a8e1
SHA256

86451aeedfa876ee1c304c001dd277f39525516a5cd51d8f22fa0cb8b6c69340
SHA512

049df881eec919600ff27acd9f5e7e3266b70904de0473b68ea95162d05232ffb2fe34fd6fa947de8169b5596f12df47b2799628f6cc41ec1ab4a3a1176f9ad7
SSDEEP

384:vQ3q0u1pTa9n37X7TkmlYDjKdyx2ygJoIo9hS:wu1pTadrX7c24VIo9h

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1428	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 1428	936	rundll32.exe	87
PID 936 wrote to memory of 1428	936	rundll32.exe	87
PID 936 wrote to memory of 1428	936	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\屏幕录像专家V60\Hook1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\屏幕录像专家V60\Hook1.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads