03ba7ea3ecfb6bd317098ba4b6a7a4fea52253f0318f2f51b2a54c4af5679b24 | Triage

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

CameraDll.dll
Size

132KB
MD5

46ffd3ea1588e45697b31c46fc3cbc3f
SHA1

c9972d2614ea38491d85d8883974b8e8c4c1529f
SHA256

5d793ff619472b6f6258ba63669cfc6e3169262f101da9afa51be6f8f35a78b8
SHA512

8b21f15fb88c641aa9775d9c0d4e6d55dbbe0cda8ff77fa47dce36c4ad833917a0ad0d6d44a0da50c94df3d5f695979fb1971e1848ab93bf135c292023ad01eb
SSDEEP

3072:cXDhPuVUnTKBb8r72RQgSNdw4j5odgyM1bR0t:cO3BYYIdw4j5o

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2988	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2988	2024	rundll32.exe	30
PID 2024 wrote to memory of 2988	2024	rundll32.exe	30
PID 2024 wrote to memory of 2988	2024	rundll32.exe	30
PID 2024 wrote to memory of 2988	2024	rundll32.exe	30
PID 2024 wrote to memory of 2988	2024	rundll32.exe	30
PID 2024 wrote to memory of 2988	2024	rundll32.exe	30
PID 2024 wrote to memory of 2988	2024	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CameraDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CameraDll.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads