e0c67ee40b42cb2d5ebf4acfa134f2f74c6411c8175bfa9d75d9e1879b890cda | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 11:10

Sharing

Report Analysis Logs

General

Target

d35b48c7c3d0d9fb8572d2cd18070c27.dll
Size

52KB
MD5

d35b48c7c3d0d9fb8572d2cd18070c27
SHA1

3dad9f1767e4a0890e6455dd8deba90c19051852
SHA256

e0c67ee40b42cb2d5ebf4acfa134f2f74c6411c8175bfa9d75d9e1879b890cda
SHA512

96032e13cc11ff808d257737cbde14cf90b668bf41baca1ef995ebc9904852952bd6efcabad2fa67a72785efd6f537b55eee7ba72032864e7166fd2a9f9135be
SSDEEP

768:C6igiQixu7HSM168ewWQVcjiijTh6+V1g:D0YyQDqNjt7V1

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2788	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2788	2772	rundll32.exe	28
PID 2772 wrote to memory of 2788	2772	rundll32.exe	28
PID 2772 wrote to memory of 2788	2772	rundll32.exe	28
PID 2772 wrote to memory of 2788	2772	rundll32.exe	28
PID 2772 wrote to memory of 2788	2772	rundll32.exe	28
PID 2772 wrote to memory of 2788	2772	rundll32.exe	28
PID 2772 wrote to memory of 2788	2772	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d35b48c7c3d0d9fb8572d2cd18070c27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d35b48c7c3d0d9fb8572d2cd18070c27.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2788-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download