f4665a7274e113691256ab2e8d894098a5861558492ad71ee76544d029a172c1 | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:54

Sharing

Report Analysis Logs

General

Target

VideoWindow.dll
Size

236KB
MD5

2ee9f1a91ed55c38d58c1e00e8fb0639
SHA1

807fe69406f1aa57cab47c220d5403ab0f7be7d5
SHA256

35d3306841d5ac8cea916ffb0f0b7cae3976608344e8780a43cc35f698f4f2ca
SHA512

3409d11055b3e2b00b24e159d8ab6653aa76ada6e87c54db7a2cf8061fa38d861495af5f4a14b769a8c558bb7bb5f6879646ad99c67a0b91a0cb9df87cd2183d
SSDEEP

3072:IoeFeneYLIiesvQEq6A7F6hL4m+VnS5dDg261uhXa04YD:IDke39oq6A7Q+VIdDiyXa4

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1840 rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1844 wrote to memory of 1840	1844	rundll32.exe	rundll32.exe
PID 1844 wrote to memory of 1840	1844	rundll32.exe	rundll32.exe
PID 1844 wrote to memory of 1840	1844	rundll32.exe	rundll32.exe
PID 1844 wrote to memory of 1840	1844	rundll32.exe	rundll32.exe
PID 1844 wrote to memory of 1840	1844	rundll32.exe	rundll32.exe
PID 1844 wrote to memory of 1840	1844	rundll32.exe	rundll32.exe
PID 1844 wrote to memory of 1840	1844	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VideoWindow.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1844

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VideoWindow.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:1840

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...