b2fe24ecb241ccdb6d8365324966f2de9d441cf695cbc1d12335a066bd58bb23 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-03-2024 12:42

Sharing

Report Analysis Logs

General

Target

d38a602315f8c735412fb25837b33d26.dll
Size

56KB
MD5

d38a602315f8c735412fb25837b33d26
SHA1

d2a6a4b1c4fb1ea7a18234d651121e70485fe4f8
SHA256

b2fe24ecb241ccdb6d8365324966f2de9d441cf695cbc1d12335a066bd58bb23
SHA512

629c8be034b253af557026f6ccc6332d31f1bb2b279c7d0f7a5a60f41731c7f3daf16cc030560daa615a1f61213cfd63f42fc743b8ddd1cd21aa6abb4dc12828
SSDEEP

1536:m1qDQzZt7fbN0iu8ejliHCj/tuLCWyyTCI:7WZxzN0TjPuLCWyyl

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2820	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2820	1688	rundll32.exe	28
PID 1688 wrote to memory of 2820	1688	rundll32.exe	28
PID 1688 wrote to memory of 2820	1688	rundll32.exe	28
PID 1688 wrote to memory of 2820	1688	rundll32.exe	28
PID 1688 wrote to memory of 2820	1688	rundll32.exe	28
PID 1688 wrote to memory of 2820	1688	rundll32.exe	28
PID 1688 wrote to memory of 2820	1688	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d38a602315f8c735412fb25837b33d26.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d38a602315f8c735412fb25837b33d26.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2820-0-0x0000000000120000-0x0000000000132000-memory.dmp

Filesize
72KB

Download
memory/2820-1-0x0000000000120000-0x0000000000132000-memory.dmp

Filesize
72KB

Download