adde6e34140cc3acf1db7a9c26e503c08a2bf26f3672223e6c03b819bcdb769a | Triage

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 06:18

Sharing

Report Analysis Logs

General

Target

IWM.dll
Size

5KB
MD5

49e240cd2e8fe880e177e208aaf8feea
SHA1

54e9ee5a7523148542113ee654f00ea13d3ca3d7
SHA256

f1b86ba7a2c3aa753966cc67bc5efb4e4badb670b6a0e56ffcfdcbbc379108fc
SHA512

e92efd1d0ab3249d6c93b32af0885e22726421055bff36dcf64d307ef2f8aaf2dd06c221342bd5e2a1fadb5d61ac284cd39750cdf1134fd530ba9ff1744d965f
SSDEEP

48:6gklbEwQo80EE/KD4XJ2zlN03t4octKoPIIaiFcBakgkHRf2r:6gSEDDM+N03O9cowIaihsHRf2r

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2332	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2332	2316	rundll32.exe	28
PID 2316 wrote to memory of 2332	2316	rundll32.exe	28
PID 2316 wrote to memory of 2332	2316	rundll32.exe	28
PID 2316 wrote to memory of 2332	2316	rundll32.exe	28
PID 2316 wrote to memory of 2332	2316	rundll32.exe	28
PID 2316 wrote to memory of 2332	2316	rundll32.exe	28
PID 2316 wrote to memory of 2332	2316	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IWM.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\IWM.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads