5318739a0a7ac64d992edf27091adad9610a821c92f4a92793543b214d96a308 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 13:23

Sharing

Report Analysis Logs

General

Target

MouseHook.dll
Size

31KB
MD5

4c98a0b4635b39f0b58d2452ed68cfc1
SHA1

2cc99264344aad0ac62347298b609a963a8d9f06
SHA256

9d4f32310d1d1c7361b3a6719e556ff04b951e5512800232ef6c3f51c3a17ace
SHA512

3c5c0734d389ceb2b6818977b4291f037aafb27def54601717ba7c62d6c063d245675615b2d1771b50ec39b17ad22c2c735d1a4dba94bcb8e7d555e3dfc4507c
SSDEEP

768:EHr98zW8XvCBcaxZupGai292OKcojTuerV:EL98zW8fCWa/m2OKcoBV

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2184	2124	rundll32.exe	28
PID 2124 wrote to memory of 2184	2124	rundll32.exe	28
PID 2124 wrote to memory of 2184	2124	rundll32.exe	28
PID 2124 wrote to memory of 2184	2124	rundll32.exe	28
PID 2124 wrote to memory of 2184	2124	rundll32.exe	28
PID 2124 wrote to memory of 2184	2124	rundll32.exe	28
PID 2124 wrote to memory of 2184	2124	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MouseHook.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MouseHook.dll,#1
  2⤵
  PID:2184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads