d1505a8ac2409207637b344848d53a2e189a04873ebc87ac3155f7cd05b0e348 | Triage

Analysis

max time kernel
3s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 20:52

Sharing

Report Analysis Logs

General

Target

hintBroswer.dll
Size

329KB
MD5

53620daed9b3c55452982a78b2a15409
SHA1

dcdcb54fc58aace0d5edf69a1ead9fffe72453bb
SHA256

d79993f18c2d83f8e68c31b2f0d8de9ff2d37dd2ea2305599ad0b9f3e4352d94
SHA512

0379395f69d1c2cd4869dc50c125a827b5e3c10161aa8fd16d861e550ea3cd8525610808ed08993250c432323adee11d43a8270d5cf702a3b475fd3cdd069e5b
SSDEEP

6144:Q9zGFLwQepS6G8CXf/hDJXliZatSZNfewF61Un4mGyj7IvB:cpS6xCvliItSZNfl61UGhJ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1724 wrote to memory of 1216	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1216	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1216	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1216	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1216	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1216	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1216	1724	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintBroswer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintBroswer.dll,#1
2⤵
PID:1216

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-54-0x0000000000000000-mapping.dmp

Download
memory/1216-55-0x0000000075011000-0x0000000075013000-memory.dmp

Filesize
8KB

Download