d1505a8ac2409207637b344848d53a2e189a04873ebc87ac3155f7cd05b0e348 | Triage

Analysis

max time kernel
45s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 20:52

Sharing

Report Analysis Logs

General

Target

hinths.dll
Size

82KB
MD5

105a7ce0e8b1abc9d4b68bb431307414
SHA1

2f4c89e208686cb4cb7d88822786b5e2d0f4385b
SHA256

5d3aac6b6a4476c9b94316cd0cb2075a77fd1bf1d91c8ac6c14a816932c8f0d2
SHA512

d3ddb7645b663229e773d320a6420e53516415bf865777e3942cd4b378aa850a22406429934ca3b8a37cadcd79ec117b30bf01afba8a9f99afe67229d91e2f80
SSDEEP

1536:xM0izkvOAkCU6ypbZLSlFkwGmAlJkTsqrm:xM0iz4kxTLuzAlMrS

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1500 wrote to memory of 1932	1500	rundll32.exe	rundll32.exe
PID 1500 wrote to memory of 1932	1500	rundll32.exe	rundll32.exe
PID 1500 wrote to memory of 1932	1500	rundll32.exe	rundll32.exe
PID 1500 wrote to memory of 1932	1500	rundll32.exe	rundll32.exe
PID 1500 wrote to memory of 1932	1500	rundll32.exe	rundll32.exe
PID 1500 wrote to memory of 1932	1500	rundll32.exe	rundll32.exe
PID 1500 wrote to memory of 1932	1500	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hinths.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hinths.dll,#1
2⤵
PID:1932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-54-0x0000000000000000-mapping.dmp

Download
memory/1932-55-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1932-56-0x00000000376A0000-0x00000000376B0000-memory.dmp

Filesize
64KB

Download