ec4a958ab73fa233b4bb5cbaf68ea3486384997d53740bfa9c3307ce150a59dd | Triage

Analysis

max time kernel
146s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
28-04-2024 10:49

Sharing

Report Analysis Logs

General

Target

screenhooks32.dll
Size

78KB
MD5

f164c24fc798a4cc39a85fb07a293e5c
SHA1

a1a51a6a692781108f54da5478008b8b519df9c1
SHA256

1842aa25c8b4d356d0d52ba08f527364f125e451255dc9799f2304fb99096286
SHA512

617b08a6fe0fda48a22281e2d9a4a3667ba796215f674f7c40e831761e7cc3f9a1ff39e719e07b7ae156befb24177847a70708de1d02285fc9d0c87bb389a3c5
SSDEEP

1536:ijQ9fdeFzsDCwWEhRRhr5/9hRUl9X3hV:ijQBcFzsDoEhRRhr5jq

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

rundll32.exe

pid process

4212 rundll32.exe
4212 rundll32.exe
4212 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4252 wrote to memory of 4212	4252	rundll32.exe	rundll32.exe
PID 4252 wrote to memory of 4212	4252	rundll32.exe	rundll32.exe
PID 4252 wrote to memory of 4212	4252	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\screenhooks32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4252

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\screenhooks32.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:4212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads