f4054cff11bed4262ce7f99fd3cb69c3358102cf3543ddc4428742b73745fde9

Analysis

max time kernel
121s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2022 07:32

Target

HRSword-main/behavior.dll
Size

329KB
MD5

d96cf66116bccec9c06e5c9d0f18a0c7
SHA1

21d02f2f418a02a62aa48c8045501f955a707a58
SHA256

57d7504837a7a39eeb1c0ed3840a67e282d84d5ad7fb40e7581a2f84a914384c
SHA512

15a8d4ab92171e5a707aa3d30fe032dae8fd7f52206d09edda52dc3ab8833cf1d8265985d163a5a6959d5ad6a469286c5dab0e040daa934c740d654f9fb3a813
SSDEEP

6144:ZC8O33S5vYia+dZVTBrwkTNUhXzIRN2j1f2GUahSzIg1coFy3:I8OHWYiDdHT5dajIRNqf2Va8I8FS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 604	3528	rundll32.exe	82
PID 3528 wrote to memory of 604	3528	rundll32.exe	82
PID 3528 wrote to memory of 604	3528	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HRSword-main\behavior.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HRSword-main\behavior.dll,#1
  2⤵
  PID:604