1a060d1dabd86e25cb6aab039a0fdccd176cb033e5c7823164b97b9284e34191 | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 21:56

Sharing

Report Analysis Logs

General

Target

ImLookExU.dll
Size

262KB
MD5

6527be4d6a3333dc5a49218c4f80530d
SHA1

97c8965b01d2644fb17a0f818af59bc0471e38a7
SHA256

908ab22cb8fa1b9125cf5746e5591fd84e4853326a812b9431ca1c0b9e997e1f
SHA512

69a57cc28583861b97a02968106f007d56c2b5826fc5aa843978f0bf3a3f155ad9f2b7dfbe8260e38c2a7b1ed759f6f6fadbeef32cec9d7c4ab8f541f645dc5b
SSDEEP

6144:2X6ytmY4o8xnZSYDI73lFlNogVFl4OgqxLwSrIs:2X6ytmY4pZSYkTlNTfw2Is

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2164 wrote to memory of 1320	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 1320	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 1320	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 1320	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 1320	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 1320	2164	rundll32.exe	rundll32.exe
PID 2164 wrote to memory of 1320	2164	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ImLookExU.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ImLookExU.dll,#1
2⤵
PID:1320

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1320-1-0x0000000000280000-0x0000000000290000-memory.dmp

Filesize
64KB

Download
memory/1320-2-0x0000000001DF0000-0x0000000001E7E000-memory.dmp

Filesize
568KB

Download