9d79253f72aa762f479c72f2d6e58c8ecf587879d11fc2eec2040c513a076a51 | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 20:57

Sharing

Report Analysis Logs

General

Target

c6d7785fa2bb4409cf2ff89c054fd06a.dll
Size

28KB
MD5

c6d7785fa2bb4409cf2ff89c054fd06a
SHA1

74cccc7abe23b7c76ed09a9ed537d1b8b968d06d
SHA256

9d79253f72aa762f479c72f2d6e58c8ecf587879d11fc2eec2040c513a076a51
SHA512

51ca275381845ff406d8b1512d370f185ee68e35d317cc7e9879ed8734520496c364eb97601d270c1eb47c304ad6073bce41c8133fdd671a0903ecc1fb75ff8f
SSDEEP

768:u7ECqVdKDcsG/szpVxwaiI+21ZRzfaMpZ:u7ECqLMccvxj+yOkZ

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2160	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2160	2552	rundll32.exe	28
PID 2552 wrote to memory of 2160	2552	rundll32.exe	28
PID 2552 wrote to memory of 2160	2552	rundll32.exe	28
PID 2552 wrote to memory of 2160	2552	rundll32.exe	28
PID 2552 wrote to memory of 2160	2552	rundll32.exe	28
PID 2552 wrote to memory of 2160	2552	rundll32.exe	28
PID 2552 wrote to memory of 2160	2552	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6d7785fa2bb4409cf2ff89c054fd06a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6d7785fa2bb4409cf2ff89c054fd06a.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads