fb851da6829c950ad8d82ab9335b8d2438951509b45319ae89ee76b0487ea75e | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 18:15

Sharing

Report Analysis Logs

General

Target

Plus/SystemOptimize.dll
Size

222KB
MD5

d8c4d25edf1bfc118b2e7c34e1432f1a
SHA1

9b738aa997fcb0a5d7102bb074a2e7fb3e8a6c74
SHA256

8d50b58ab7fd0e99eab1f41b71ca3d936708b37446a5fb5f32abfd9f62a2c999
SHA512

4418909a7cad08508faaffe8f0cf8e63acbf1bc5c3978ce831506723dacb6de31b26a5d2b15228944e85dc5b6e2bda5868774070231e132dd36435a96f000dd7
SSDEEP

6144:7xIX9CflaIXOchXM879qZ2yQGLXN411gwKa:DaI/hXMi9qZ2yQGLXSK

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2304	rundll32.exe
2304	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2304	2276	rundll32.exe	28
PID 2276 wrote to memory of 2304	2276	rundll32.exe	28
PID 2276 wrote to memory of 2304	2276	rundll32.exe	28
PID 2276 wrote to memory of 2304	2276	rundll32.exe	28
PID 2276 wrote to memory of 2304	2276	rundll32.exe	28
PID 2276 wrote to memory of 2304	2276	rundll32.exe	28
PID 2276 wrote to memory of 2304	2276	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plus\SystemOptimize.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plus\SystemOptimize.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads