9485e528a0423d103c0f82360f9b087854a2209bcfa794bc1cf85dc626fe2c08 | Triage

Analysis

max time kernel
51s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 01:40

Sharing

Report Analysis Logs

General

Target

ImLookExU.dll
Size

262KB
MD5

c3d6a629966b2de0ac954c0c75847f59
SHA1

8109256492cb3a2a38a6587b7e1145c58e078769
SHA256

0e469f31a8399483862231a0fe5b78bf90a7df4ac5c0470ae79adc33e4a42d10
SHA512

c80f718baa86aa05a566b8b5f8087a9f32703ef8f00ded809e0a2d74e94604b4b524989d953e26b9752e02fe2601ebe6527ef03384f6368ff6e5dca289a857e0
SSDEEP

6144:9X6yu38mY4o8xnZSYDI7jlFl4oYVFl4OgqAIwMr5s:9X6yhmY4pZSYkvl4/NwU5s

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 6124	3880	rundll32.exe	81
PID 3880 wrote to memory of 6124	3880	rundll32.exe	81
PID 3880 wrote to memory of 6124	3880	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ImLookExU.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ImLookExU.dll,#1
  2⤵
  PID:6124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/6124-0-0x0000000002220000-0x00000000022AE000-memory.dmp

Filesize
568KB

Download