f4054cff11bed4262ce7f99fd3cb69c3358102cf3543ddc4428742b73745fde9 | Triage

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 07:32

Sharing

Report Analysis Logs

General

Target

HRSword-main/libcodecs.dll
Size

1.8MB
MD5

d26d00c7b3783d265ee335c861d9d64f
SHA1

a07eb34a9e1f0c5152bd55888ed6e52ab48cf312
SHA256

29d1949704de77f97c2d2bc5e1b683fef0f2cc6c2b0ee7fe0b281f916c2052c6
SHA512

7269f1bee27ae896afe64e0f389956aa582dee90b4068c2edbf73c9fb4e219adf6450a50084c2386e9d661c0d8ecd691c196c2e50fb6a79cb65507c03c7a0107
SSDEEP

49152:f323SX+j0ZSq7Bg8kKeNrIZCj/XfFtsaLMXhi:fJ+wZSKBglKeNrIZC4aLN

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27
PID 1696 wrote to memory of 944	1696	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HRSword-main\libcodecs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HRSword-main\libcodecs.dll,#1
  2⤵
  PID:944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/944-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download