89697a81eea1f36a9cd76c46900364fff3b341c3ff41d6843292d84ae1cbb378 | Triage

Analysis

max time kernel
94s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 05:39

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/installhelper.dll
Size

138KB
MD5

c3a9ed3b7333b8b0c3cce453cc81380c
SHA1

6621e4fda8f92870c79f44c0452685a80c624c29
SHA256

e691d5c6ef4a6cc0008cc4ad83b83b3aa3eed7eda71b2bc8ccd466d7d16b25a7
SHA512

b06cb61b91c55ef61deb82ff3ee9572c439efd1a8453db11c4da2ff95fdc59e82fdf1ea15cfb533e40aa78e5a1ce68910c460750be1bda0f722242f3138200c3
SSDEEP

3072:poZG3oh4e1Ok3biiBVpKJ8PMB+6Us5e3i:p6v4eUAVpKJ8/Rae3i

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2332	rundll32.exe
2332	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 2332	3464	rundll32.exe	84
PID 3464 wrote to memory of 2332	3464	rundll32.exe	84
PID 3464 wrote to memory of 2332	3464	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\installhelper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\installhelper.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2332-0-0x00000000013A0000-0x00000000013A1000-memory.dmp

Filesize
4KB

Download