6a29f0a6a9862c16017828dbc81515fd33f974787200603f1bbfe07c5ee66224 | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 20:37

Sharing

Report Analysis Logs

General

Target

d70fb1596b92e1740f32435aae08fd4d.dll
Size

39KB
MD5

d70fb1596b92e1740f32435aae08fd4d
SHA1

56e26be8ec73fbfa4305ff644c1f95bf6ab2dfe9
SHA256

6a29f0a6a9862c16017828dbc81515fd33f974787200603f1bbfe07c5ee66224
SHA512

2f7acb23efbb32a15fecd163d7f13255baa06f61c65420b8f326aed3e361c10941deed8daff7a161729a82f42d59438d97d50300af0b18fc9fd55b9d34331007
SSDEEP

768:QyIqVQZvwoDXGIaoqf5gj2d83oquHYIoDjwJxZ6f:nIqVQB/yIn684quHYIowd6

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2836	rundll32.exe
2836	rundll32.exe
2836	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2836	2684	rundll32.exe	28
PID 2684 wrote to memory of 2836	2684	rundll32.exe	28
PID 2684 wrote to memory of 2836	2684	rundll32.exe	28
PID 2684 wrote to memory of 2836	2684	rundll32.exe	28
PID 2684 wrote to memory of 2836	2684	rundll32.exe	28
PID 2684 wrote to memory of 2836	2684	rundll32.exe	28
PID 2684 wrote to memory of 2836	2684	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d70fb1596b92e1740f32435aae08fd4d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d70fb1596b92e1740f32435aae08fd4d.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads