bbfe5eaa0138f51710292488a384e4f6dcb65a6cba2a4c63387c714cec753d6e | Triage™

Analysis

max time kernel
2s
max time network
8s
platform
windows7_x64
resource
win7v20201028
submitted
12/02/2021, 10:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hpqhvsei.dll
Size 347KB
Sample210212-yaxe59b346
SHA256 bbfe5eaa0138f51710292488a384e4f6dcb65a6cba2a4c63387c714cec753d6e
MD5 ae8f01b1130bf479219e9204e1db35da
SHA1 2de13c831f0a64811a2b28c57854229dab2baaf9
SHA512 beddb4cca020e559cc7f539a72a7e0d0b81982f3feb34e5887f80788816276cf912895f2bbbbaa83c8a20f253a7028f5bc81199c5e01245612ba4bff91b3154b
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1940	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 1940	1576	rundll32.exe	25
PID 1576 wrote to memory of 1940	1576	rundll32.exe	25
PID 1576 wrote to memory of 1940	1576	rundll32.exe	25
PID 1576 wrote to memory of 1940	1576	rundll32.exe	25
PID 1576 wrote to memory of 1940	1576	rundll32.exe	25
PID 1576 wrote to memory of 1940	1576	rundll32.exe	25
PID 1576 wrote to memory of 1940	1576	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hpqhvsei.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\hpqhvsei.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1940-3-0x0000000075A41000-0x0000000075A43000-memory.dmp

Download