2d52ef6c7d66fed4ca81a4a0e0adfad036d24653700fd17a45366826ce0ad45a | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 17:22

Sharing

Report Analysis Logs

General

Target

MouseHook.dll
Size

32KB
MD5

30d0890b84494f4d4689037b6126bba4
SHA1

dd5bf37c4751710c57d1e95e29ce6e890ec73a25
SHA256

fc07f2c9c5830056e51f02e6e85195d89af51c3e9d7d42de56049a6261bbfb02
SHA512

545ec0918da23acb984241b668eb6db3bc297c16e754ae472c8f8745c62811fb9d1501f75e205064760bee7b46eae6bf4687990e1b50f9aa755b2b0b6cbf6cff
SSDEEP

768:3Hr98zW8XvCBcaxFUpGai292OKjojDd7paqIp:3L98zW8fCWafw2OKjoN7O

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1608	1852	rundll32.exe	28
PID 1852 wrote to memory of 1608	1852	rundll32.exe	28
PID 1852 wrote to memory of 1608	1852	rundll32.exe	28
PID 1852 wrote to memory of 1608	1852	rundll32.exe	28
PID 1852 wrote to memory of 1608	1852	rundll32.exe	28
PID 1852 wrote to memory of 1608	1852	rundll32.exe	28
PID 1852 wrote to memory of 1608	1852	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MouseHook.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MouseHook.dll,#1
  2⤵
  PID:1608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads