d1505a8ac2409207637b344848d53a2e189a04873ebc87ac3155f7cd05b0e348 | Triage

Analysis

max time kernel
178s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 20:52

Sharing

Report Analysis Logs

General

Target

hintui.dll
Size

454KB
MD5

2921cf2c9341fd87d01177af3db7d9fc
SHA1

5e4790ca4d0f617aad39fd247687087689afa791
SHA256

54827e55704dd1551b5d13fd6404913d2dc229d9316ca995538f39cab60b3198
SHA512

891b31fd62faa91c4b1d53d179a6d2ef6c3f5c564eaeaf26ef4366234775299454f6f46c7c611d9f8833ce8daa1d7589491b1d94ea7da8d7f87ba95de66322be
SSDEEP

6144:9rNJONfNjXk6gW3v1yQYg1ktw1cmH7BnE6V2deXqOga2NOLKib:9ZJON269yqktw1cm/Ke6xNCxb

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1200 3220 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 832 wrote to memory of 3220	832	rundll32.exe	rundll32.exe
PID 832 wrote to memory of 3220	832	rundll32.exe	rundll32.exe
PID 832 wrote to memory of 3220	832	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:832

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintui.dll,#1
2⤵
PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 700
3⤵
- Program crash
PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3220 -ip 3220
1⤵
PID:3872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3220-132-0x0000000000000000-mapping.dmp

Download