d1505a8ac2409207637b344848d53a2e189a04873ebc87ac3155f7cd05b0e348

Analysis

max time kernel
31s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 20:52

Target

hintnobho.dll
Size

114KB
MD5

f6c801aec83ec81d81c9f92f88b9667b
SHA1

3e7041f074b120748d9e64ccb1c6610d5e4d77cf
SHA256

05f1a854b4d377121bec653e06e024cdb1376b9778615157a6e38d0cc7f763ca
SHA512

0d251217a7fd93de61e396eb2f204d8870db0cb20b547f46c1d3d4c7ddd42b7527dd87f8c9cf60368762043752ea04bb7c997202538c8027bb075bfd94f9c906
SSDEEP

1536:7hlWeFGpGVy2bIt3fzRhgXIYWTpsQ/UDbt5TRy5HA5DEgVMCInIlbInb2errj:LFGpijgf7WIPNZ/KOgVMbnIlb+2ern

Score

5^/10

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\hintnobho.log rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1496 1944 WerFault.exe rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\hintnobho.log	rundll32.exe

pid	pid_target	process	target process
1496	1944	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1708 wrote to memory of 1944	1708	rundll32.exe	rundll32.exe
PID 1708 wrote to memory of 1944	1708	rundll32.exe	rundll32.exe
PID 1708 wrote to memory of 1944	1708	rundll32.exe	rundll32.exe
PID 1708 wrote to memory of 1944	1708	rundll32.exe	rundll32.exe
PID 1708 wrote to memory of 1944	1708	rundll32.exe	rundll32.exe
PID 1708 wrote to memory of 1944	1708	rundll32.exe	rundll32.exe
PID 1708 wrote to memory of 1944	1708	rundll32.exe	rundll32.exe
PID 1944 wrote to memory of 1496	1944	rundll32.exe	WerFault.exe
PID 1944 wrote to memory of 1496	1944	rundll32.exe	WerFault.exe
PID 1944 wrote to memory of 1496	1944	rundll32.exe	WerFault.exe
PID 1944 wrote to memory of 1496	1944	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintnobho.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 228
3⤵
- Program crash
PID:1496

memory/1496-56-0x0000000000000000-mapping.dmp

Download
memory/1944-54-0x0000000000000000-mapping.dmp

Download
memory/1944-55-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download