d1505a8ac2409207637b344848d53a2e189a04873ebc87ac3155f7cd05b0e348 | Triage

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 20:52

Sharing

Report Analysis Logs

General

Target

hintsok.dll
Size

274KB
MD5

a285e5f846809642c0bf7900bab1216b
SHA1

bfd55653ae8ae1eb32a6a6207dbc5df46195517b
SHA256

f9cbd173e31342657247856037dac44e7ba1398b0c15aa4bb19784811e0fc0fd
SHA512

c677421406696bd766b02b6367ea29482232b0216379e43dd2fdaa4acac92962061c48898c38ac227fdd0263eebb23a4295575c0664161fb166ba0abe17d1ab9
SSDEEP

6144:oR52MsvCyT0hnT8Q4oHY3Spf6Is7X/zC/xwsI3tgIYtVd:I52MsvCyT0hc6SIsb/zCAgI4d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1832 wrote to memory of 1168	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1168	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1168	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1168	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1168	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1168	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1168	1832	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintsok.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintsok.dll,#1
2⤵
PID:1168

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1168-54-0x0000000000000000-mapping.dmp

Download
memory/1168-55-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download