d910030e1f0562ef78edc8f82d37e1d47ba9dbb7048086d857a1a633c24eb994 | Triage

Analysis

max time kernel
120s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 18:05

Sharing

Report Analysis Logs

General

Target

xptools690/inpout32.dll
Size

96KB
MD5

c1ccde650bf91a3b1d07dc5494d4276f
SHA1

8062e3a853769d4c8235d30b30ca97cb200b1479
SHA256

01bcec6ddb4964e1f5b69ba1bd3876221d8de7ae17cacfac66f095013434a78f
SHA512

83c3ad41ab7b35e7116208dbda9fc65ad6203f5922c3ec5e840b0c54c5d2c47127564c0ec88b3445d5563fa39cca0ac62a6ca5603118e317523ae822d06e897c
SSDEEP

1536:o/Y+Lhxv0hDuC0+5/CH8KM3xtGQI0jqSG0jVf:ozL7E/fhtGQwSR

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\Drivers\inpoutx64.sys	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 388	3628	rundll32.exe	85
PID 3628 wrote to memory of 388	3628	rundll32.exe	85
PID 3628 wrote to memory of 388	3628	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xptools690\inpout32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\xptools690\inpout32.dll,#1
  2⤵
  - Drops file in Drivers directory
  PID:388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads