9eedec7a4c14e97094097b333883a2c27de961be541a63bcd1a080cb702ae40b | Triage

Analysis

max time kernel
20s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-09-2022 05:32

Sharing

Report Analysis Logs

General

Target

hpmcro32.dll
Size

13KB
MD5

5ddeca6443e5c2cf7a4525c47488e496
SHA1

5099f4252b04f3fbae3fb8b26bd81cfb12d694d0
SHA256

72a5d9f7a3f286062a16d3e7b7ffff9530aa8bc81f8de863a00f1ba1becd9b99
SHA512

43d971056e1dca7d17dc451b27c75d15631eaf8e0f9ff54d7982b070194d6a1151792c99e84a1e380bc72669077d94ed6f801f2ea5a39f9f78eaf48569dfdabc
SSDEEP

384:5ZyrNrVUUuirfGh08ZUuux26C0Det+JoNSqWljW:nyz/1r0M

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 696	1644	rundll32.exe	27
PID 1644 wrote to memory of 696	1644	rundll32.exe	27
PID 1644 wrote to memory of 696	1644	rundll32.exe	27
PID 1644 wrote to memory of 696	1644	rundll32.exe	27
PID 1644 wrote to memory of 696	1644	rundll32.exe	27
PID 1644 wrote to memory of 696	1644	rundll32.exe	27
PID 1644 wrote to memory of 696	1644	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hpmcro32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\hpmcro32.dll,#1
  2⤵
  PID:696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/696-55-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download