d1505a8ac2409207637b344848d53a2e189a04873ebc87ac3155f7cd05b0e348 | Triage

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 20:52

Sharing

Report Analysis Logs

General

Target

hintcver.dll
Size

134KB
MD5

94526e3b91b2ee984565da2b23262291
SHA1

8e8e8d6cd1b07701869e8ccdedbe637c1ed15492
SHA256

d492715ff65768fbdb9928d978954809254a12976364c5768529af67ec0e32b9
SHA512

dc0722615d503d2d725a78bf7cf17fd17398518a4f010fea583a2af3404ee867aec84e71295789160a77d350a3cc83357e8548afb7162d6b3a720a3cdeeb8f05
SSDEEP

3072:SiL3w3NV5WGPbBVGQOpoht8lnEc4+RIM88SVy:VzOYGPFVGpLEKp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1908 wrote to memory of 1944	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 1944	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 1944	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 1944	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 1944	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 1944	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 1944	1908	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintcver.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintcver.dll,#1
2⤵
PID:1944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-54-0x0000000000000000-mapping.dmp

Download
memory/1944-55-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1944-56-0x0000000074AB0000-0x0000000074AC3000-memory.dmp

Filesize
76KB

Download
memory/1944-57-0x0000000074A60000-0x0000000074AA5000-memory.dmp

Filesize
276KB

Download