e21d43f1fc12059ac755b1160a88afe7debff2e41dd6136a2e9c3f5175678bab | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 07:56

Sharing

Report Analysis Logs

General

Target

e12a738d0432b2cf41ac3dc82e6d64b0.dll
Size

10KB
MD5

e12a738d0432b2cf41ac3dc82e6d64b0
SHA1

b7a21dccec27eb7c29be3dfae38a92343de6150a
SHA256

e21d43f1fc12059ac755b1160a88afe7debff2e41dd6136a2e9c3f5175678bab
SHA512

9bdd1f3f2414d78341f77e297f50a0f0ea2b9d5aff2b07bad5e2050a4a3649b6ef73d97843a2f9d17a3b21b34b43a303572c7aeb02688d8e513c301b8b482de7
SSDEEP

192:p4r7TtEVeNUcnE5DdCj3msqFSGpfKFRjh9SEjP:p4rPtEynE5DAj3BqFf6jh9SkP

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
612	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 612	2180	rundll32.exe	28
PID 2180 wrote to memory of 612	2180	rundll32.exe	28
PID 2180 wrote to memory of 612	2180	rundll32.exe	28
PID 2180 wrote to memory of 612	2180	rundll32.exe	28
PID 2180 wrote to memory of 612	2180	rundll32.exe	28
PID 2180 wrote to memory of 612	2180	rundll32.exe	28
PID 2180 wrote to memory of 612	2180	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e12a738d0432b2cf41ac3dc82e6d64b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e12a738d0432b2cf41ac3dc82e6d64b0.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads