Analysis

  • max time kernel
    119s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-11-2024 21:41

General

  • Target

    resources/app.asar.unpacked/node_modules/iohook/builds/electron-v85-win32-ia32/build/Release/uiohook.dll

  • Size

    116KB

  • MD5

    091a7deacb932c361c2682f15297a13b

  • SHA1

    fd0141d5af843fb186e684f00bac5200d3b008a6

  • SHA256

    dbac4a1094dc9de4e00dbda749624aabf898db6254a3ff0fe01d608e19eaa067

  • SHA512

    14c468107cfe3dc3158b6432d32e5d4f56bdd1cea1d6db95724461c05da59fb27f6fa3b95738e8a534cd7f636952ad18cb73e2e4a736bff3544145a29e5288b3

  • SSDEEP

    3072:8+tjheWirzar7XnJ6nOqDdVpdAKcbcV1kNbnGjn:Fjc/za/J6nFVQeGnGL

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\iohook\builds\electron-v85-win32-ia32\build\Release\uiohook.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\iohook\builds\electron-v85-win32-ia32\build\Release\uiohook.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3060

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads