d1505a8ac2409207637b344848d53a2e189a04873ebc87ac3155f7cd05b0e348

Analysis

max time kernel
165s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 20:52

Target

hintva.dll
Size

354KB
MD5

324e44e4f0e91062720b00afc3a3c793
SHA1

82cab7a4b78394a3750a2b87d5bf6e920fdc31b7
SHA256

e0fa9f34b89e6f7db93aae638bcd89f61134756dcf57cc77503b1016fb7e3322
SHA512

ed90aa1e0b58c250ff73cb25c8ed2053bda8de69eccfb17bf5f239a6acad2e0e58546f175737c2d1f4508d5187b3ffe0b29e6618c8ef8e0d99e1aa590ff21aa4
SSDEEP

6144:DBmL10IepiB8Q4oHYblllQ7UrlUHQCJwF7tAM0tpRqprHWe9bxcUqUR5X:DB010Iep7bllOcqHQCaF7tAM0tGpXxm6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4876 wrote to memory of 2256	4876	rundll32.exe	rundll32.exe
PID 4876 wrote to memory of 2256	4876	rundll32.exe	rundll32.exe
PID 4876 wrote to memory of 2256	4876	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintva.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4876

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintva.dll,#1
2⤵
PID:2256