5dde351516155c3ec5f77c4b93018609d6beeb642a03f12d5da30f0e1ca9d410 | Triage

Analysis

max time kernel
13s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 06:46

Sharing

Report Analysis Logs

General

Target

RegHookSpecialist.dll
Size

135KB
MD5

bc0d79e8a7d66f61d144bdaba9f21c4e
SHA1

f79057485bf1d4dbf59039a6682f1c3459de87a8
SHA256

e562086d730661316e8195013109ca305dbb0a07f4a0ab3965daad6fab5a7166
SHA512

0effdb356df6f854f3dee8814c4f8737047422670a02db1f6a86bd1bfe544d32b66d0910c18e40b008672412e535dc3dcbba92e2cea552217382c83d97e60534
SSDEEP

3072:arxH+fulSq6qEfTvyHoBbnS4frBdZoJBLvPAY:arxH+fulSqlHHqbnSyfZoJxoY

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 1888	2484	rundll32.exe	30
PID 2484 wrote to memory of 1888	2484	rundll32.exe	30
PID 2484 wrote to memory of 1888	2484	rundll32.exe	30
PID 2484 wrote to memory of 1888	2484	rundll32.exe	30
PID 2484 wrote to memory of 1888	2484	rundll32.exe	30
PID 2484 wrote to memory of 1888	2484	rundll32.exe	30
PID 2484 wrote to memory of 1888	2484	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RegHookSpecialist.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\RegHookSpecialist.dll,#1
  2⤵
  PID:1888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads