37cae44ef1394f6a146d0bf3ec1767fd92cb9db14f4774abe338d3414baadb55 | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 05:49

Sharing

Report Analysis Logs

General

Target

d55adc94aac907731f66b3d8c7bac6c5.dll
Size

18KB
MD5

d55adc94aac907731f66b3d8c7bac6c5
SHA1

325ec6df6c3a78ff062a82341517d262e185a3bf
SHA256

37cae44ef1394f6a146d0bf3ec1767fd92cb9db14f4774abe338d3414baadb55
SHA512

01de78b6777b3f9aa9be9eaf9f9ef647483f18c49336fe1aec9803ac19dba5e052a14ca98ef4bc12c3f7a70814b542fbd99bfd976c489828aef707e3d4acc04e
SSDEEP

384:sm0OzXkJGyyCMy8yHuNxCYnRYnZytQAz1Q:sm9C38yHuXPuZQ

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2468	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2468	2264	rundll32.exe	28
PID 2264 wrote to memory of 2468	2264	rundll32.exe	28
PID 2264 wrote to memory of 2468	2264	rundll32.exe	28
PID 2264 wrote to memory of 2468	2264	rundll32.exe	28
PID 2264 wrote to memory of 2468	2264	rundll32.exe	28
PID 2264 wrote to memory of 2468	2264	rundll32.exe	28
PID 2264 wrote to memory of 2468	2264	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d55adc94aac907731f66b3d8c7bac6c5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d55adc94aac907731f66b3d8c7bac6c5.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2468-0-0x0000000000660000-0x000000000066A000-memory.dmp

Filesize
40KB

Download