38621b07458c3e8494115cd3cd6673ffaca372e87745f08d70a4838fcac33dbf | Triage

Analysis

max time kernel
39s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 20:39

Sharing

Report Analysis Logs

General

Target

HcDTvUxhMvlLtX.dll
Size

2.3MB
MD5

bc1835f0440c14366ec2f9938e4f3179
SHA1

8baed6529536aec22a320248b3dc80d02d6e3219
SHA256

c78290da99475f965ce54f737e0927a9855e03c9a27f2ee7a797562533779305
SHA512

b303957bce012e38ddfb78c9dd0237647623dcfff7919feadceef1f0f52185ead5dcab94f65597abc97d979d8b0735086f83b575f3117324e70f2871f8398134
SSDEEP

49152:if3/T7IEjqQK7GmsMKyNFyHbL8A0B1cJPr:K3//3mn7G0vy7QA0B1cJPr

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
964	1184	WerFault.exe	25

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 964	1184	rundll32.exe	26
PID 1184 wrote to memory of 964	1184	rundll32.exe	26
PID 1184 wrote to memory of 964	1184	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HcDTvUxhMvlLtX.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1184 -s 84
  2⤵
  - Program crash
  PID:964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads