d428e48a77074d621d8a375f6130e3d85b82097d6d0cc90b030557388bb9b313 | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 07:39

Sharing

Report Analysis Logs

General

Target

MouseHook.dll
Size

31KB
MD5

6e8a92fb9e6b8d4704bf243863cda92e
SHA1

c49f199a5aafab151350dad9edc924814e0acc14
SHA256

f3b7306448359dd8414cbfe18a84265459eb40844821b662de6f3bf33f1de17a
SHA512

2e3363403852ad7d744acf10f428cef31752563a1119c4875d1e031e5d0dd627ecf5b28cb39f2787bcd3e8a4eb06f8bf78969a05cbb03224a12f86b97bd008dc
SSDEEP

768:WHr98zW8XvCBcaxCYpGai292OK6ojvuerP:WL98zW8fCWac82OK6olP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MouseHook.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MouseHook.dll,#1
  2⤵
  PID:2052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads