d1505a8ac2409207637b344848d53a2e189a04873ebc87ac3155f7cd05b0e348 | Triage

Analysis

max time kernel
2s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 20:52

Sharing

Report Analysis Logs

General

Target

hintbhoii.dll
Size

162KB
MD5

114294a07ba54610f097d910a5df69ce
SHA1

9e14b5ecef65fe70f0ce9348a7d689ef0e342361
SHA256

66ade4a38c75f8986554c99b5a417193e43edba36daa65522b7635d751fac4d9
SHA512

e6b81780ab464f5eb29f9409cbb0fbb2e5873b2b8f8bd339141c9a1fbbf09abfd6c08dc989217365a48e156957e13e6fabd7ede7cb4625011d2e54d876fbd08a
SSDEEP

3072:ctt0V5516sJQY9Hu9GL1OHnEdx4wlIz6Lmw:IEhQKO9GenWx4B65

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

2012 rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1676 wrote to memory of 2012	1676	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 2012	1676	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 2012	1676	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 2012	1676	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 2012	1676	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 2012	1676	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 2012	1676	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintbhoii.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintbhoii.dll,#1
2⤵
- Suspicious use of SetWindowsHookEx
PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-54-0x0000000000000000-mapping.dmp

Download
memory/2012-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download