09f4522407d2621ea90e79f85af26bf090146fb38f33b516d970ad825194c6b4 | Triage

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 12:47

Sharing

Report Analysis Logs

General

Target

SWind.dll
Size

152KB
MD5

f5c2bc3da7f755a5b9a7ccf9008fc8b2
SHA1

543b335163413d86ff1892d3c9e9b485ed2cdc88
SHA256

09f4522407d2621ea90e79f85af26bf090146fb38f33b516d970ad825194c6b4
SHA512

049aa162d1f4c37c7e0c074b999cab8aee3fafcc38044acb7cf69e3122164cb127ef16c5c73d4e59f582e5a5877f0bce2cad14f87426fdc681b9e1627cb83740
SSDEEP

3072:G0xJDEOuV1eVZeYQZ3vgoVJu8i8IPHHl:FVuYV268aH

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2072	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2072	2004	rundll32.exe	28
PID 2004 wrote to memory of 2072	2004	rundll32.exe	28
PID 2004 wrote to memory of 2072	2004	rundll32.exe	28
PID 2004 wrote to memory of 2072	2004	rundll32.exe	28
PID 2004 wrote to memory of 2072	2004	rundll32.exe	28
PID 2004 wrote to memory of 2072	2004	rundll32.exe	28
PID 2004 wrote to memory of 2072	2004	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SWind.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SWind.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads