f4054cff11bed4262ce7f99fd3cb69c3358102cf3543ddc4428742b73745fde9

Analysis

max time kernel
102s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 07:32

Target

HRSword-main/uactmon.dll
Size

381KB
MD5

91753ecb7a58e18e6b9efe7f21dafac9
SHA1

86f74f9355d3e35fa7fdaa023d2151a7d885fd5a
SHA256

2c3adb060107024c1caef9f4e983ad589bf7246acc5b94ead2f2956ef0662461
SHA512

32e7c2b000ba593e643e254657448d5ab97ff81f455a842dea9b2e7422f418b7a0ee1089d018049c100c3c87d96894f28a0269fde6354cf1c63710d9c418db81
SSDEEP

6144:Q9TlrggXheT8zcZyXgfrR7/VOiOm8Pquk+8zcoFGBPr3sQ4:4TlB8T8zSy0rRnOJPUDfFsPr3l4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 624	1400	rundll32.exe	83
PID 1400 wrote to memory of 624	1400	rundll32.exe	83
PID 1400 wrote to memory of 624	1400	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HRSword-main\uactmon.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HRSword-main\uactmon.dll,#1
  2⤵
  PID:624