9ed0f409e7fb369f83c3aeaad4085a2146778faed15d421734aa13fe22cf7ee4 | Triage

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17-10-2024 08:11

Sharing

Report Analysis Logs

General

Target

x64/klock.dll
Size

163KB
MD5

c388b5a443746dd0c27d8ce301f86638
SHA1

a39b3cb6d9ea432fe84f51191e86b064d8ebeec9
SHA256

32b2d21062d67ae54b9d1494cf7a58b067c4a9587a83b51a0a7c4c1c0e5c427a
SHA512

121adee78f79885e06d49d698f123af7d8b4e92994e9a637d7cad46929da448e2ab6d082baae028a4aea813a70734dfa32165f00c10c5f1cbb70f8f6ea5093b2
SSDEEP

3072:QKFYz0j60Hlxr4BY6ZnhZyoPHT/yOXQsEEwlCtOJVdnha+UarPK6Ndo:QtwbXr96ZnyeT/yOXQsEzYEnFjtdo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 3044 wrote to memory of 1660	3044	rundll32.exe	30
PID 3044 wrote to memory of 1660	3044	rundll32.exe	30
PID 3044 wrote to memory of 1660	3044	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x64\klock.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3044 -s 88
  2⤵
  PID:1660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads