d1505a8ac2409207637b344848d53a2e189a04873ebc87ac3155f7cd05b0e348

Analysis

max time kernel
90s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 20:52

Target

hintnobho.dll
Size

114KB
MD5

f6c801aec83ec81d81c9f92f88b9667b
SHA1

3e7041f074b120748d9e64ccb1c6610d5e4d77cf
SHA256

05f1a854b4d377121bec653e06e024cdb1376b9778615157a6e38d0cc7f763ca
SHA512

0d251217a7fd93de61e396eb2f204d8870db0cb20b547f46c1d3d4c7ddd42b7527dd87f8c9cf60368762043752ea04bb7c997202538c8027bb075bfd94f9c906
SSDEEP

1536:7hlWeFGpGVy2bIt3fzRhgXIYWTpsQ/UDbt5TRy5HA5DEgVMCInIlbInb2errj:LFGpijgf7WIPNZ/KOgVMbnIlb+2ern

Score

5^/10

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\hintnobho.log rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1952 540 WerFault.exe rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\hintnobho.log	rundll32.exe

pid	pid_target	process	target process
1952	540	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5080 wrote to memory of 540	5080	rundll32.exe	rundll32.exe
PID 5080 wrote to memory of 540	5080	rundll32.exe	rundll32.exe
PID 5080 wrote to memory of 540	5080	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintnobho.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5080

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintnobho.dll,#1
2⤵
- Drops file in System32 directory
PID:540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 640
3⤵
- Program crash
PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 540 -ip 540
1⤵
PID:4144