d1505a8ac2409207637b344848d53a2e189a04873ebc87ac3155f7cd05b0e348

Analysis

max time kernel
36s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 20:52

Target

hintsnake.dll
Size

112KB
MD5

f4ba30629f1d7a5c16d74a64232ac56e
SHA1

552f4513c58aadef99123459c8a3f9a27e6fc6b9
SHA256

ca45f4440297b0755509a1a8998903e981c520a5bf85141d8c0930396a4ecd06
SHA512

d3bb7f3957baeb16682f351e42d5c29a1d20a0ee9ef7a2b98ec96fb8bea9792ba4409e2466e0fe760db1027c17b0c7987b3f7c7229eeefef423a525107137630
SSDEEP

1536:qFNKbEMQQ+JcSxmvIafvYFbju1Ifn32KEJ/kmyNYB1vxhOS6SL5GkNNNNUe71kPQ:q6qdJcSmPbIJET1jd15GkNNNNUe7vf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1508 wrote to memory of 1516	1508	rundll32.exe	rundll32.exe
PID 1508 wrote to memory of 1516	1508	rundll32.exe	rundll32.exe
PID 1508 wrote to memory of 1516	1508	rundll32.exe	rundll32.exe
PID 1508 wrote to memory of 1516	1508	rundll32.exe	rundll32.exe
PID 1508 wrote to memory of 1516	1508	rundll32.exe	rundll32.exe
PID 1508 wrote to memory of 1516	1508	rundll32.exe	rundll32.exe
PID 1508 wrote to memory of 1516	1508	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintsnake.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintsnake.dll,#1
2⤵
PID:1516

memory/1516-54-0x0000000000000000-mapping.dmp

Download
memory/1516-55-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download