d1505a8ac2409207637b344848d53a2e189a04873ebc87ac3155f7cd05b0e348 | Triage

Analysis

max time kernel
329s
max time network
404s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 20:52

Sharing

Report Analysis Logs

General

Target

hintbhoii.dll
Size

162KB
MD5

114294a07ba54610f097d910a5df69ce
SHA1

9e14b5ecef65fe70f0ce9348a7d689ef0e342361
SHA256

66ade4a38c75f8986554c99b5a417193e43edba36daa65522b7635d751fac4d9
SHA512

e6b81780ab464f5eb29f9409cbb0fbb2e5873b2b8f8bd339141c9a1fbbf09abfd6c08dc989217365a48e156957e13e6fabd7ede7cb4625011d2e54d876fbd08a
SSDEEP

3072:ctt0V5516sJQY9Hu9GL1OHnEdx4wlIz6Lmw:IEhQKO9GenWx4B65

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2660 wrote to memory of 4848	2660	rundll32.exe	rundll32.exe
PID 2660 wrote to memory of 4848	2660	rundll32.exe	rundll32.exe
PID 2660 wrote to memory of 4848	2660	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintbhoii.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2660

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintbhoii.dll,#1
2⤵
PID:4848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4848-132-0x0000000000000000-mapping.dmp

Download