4b27de8a7f73d469420c292dc63c895c075dfb3d6d641781eadeac3646e5f704 | Triage

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 18:15

Sharing

Report Analysis Logs

General

Target

MouseHook.dll
Size

32KB
MD5

83e96e88af411677973c5b17c7d44fd9
SHA1

b8df234b5822eae22efa51ca3239885c08b2c5ec
SHA256

81b1e978de4f4191449a031d6c0b792197ad7abde4b58e9bb284e3a0304b4cb0
SHA512

f3264cf3a52fcb2a3a02628125e98598fdb1265c4ff36ea4017d3ef1b3d1941def6331bd8b087a8707dc165c541182c8c64dee27951c23aeef444ee1f6b1b532
SSDEEP

768:MHr98zW8XvCBcax7BpGai292OKtFLWNKDmSv6a:ML98zW8fCWaB12OKtFKda

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2964 wrote to memory of 2792	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 2792	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 2792	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 2792	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 2792	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 2792	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 2792	2964	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MouseHook.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2964

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MouseHook.dll,#1
2⤵
PID:2792

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...