d1505a8ac2409207637b344848d53a2e189a04873ebc87ac3155f7cd05b0e348 | Triage

Analysis

max time kernel
148s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 20:52

Sharing

Report Analysis Logs

General

Target

hintcver.dll
Size

134KB
MD5

94526e3b91b2ee984565da2b23262291
SHA1

8e8e8d6cd1b07701869e8ccdedbe637c1ed15492
SHA256

d492715ff65768fbdb9928d978954809254a12976364c5768529af67ec0e32b9
SHA512

dc0722615d503d2d725a78bf7cf17fd17398518a4f010fea583a2af3404ee867aec84e71295789160a77d350a3cc83357e8548afb7162d6b3a720a3cdeeb8f05
SSDEEP

3072:SiL3w3NV5WGPbBVGQOpoht8lnEc4+RIM88SVy:VzOYGPFVGpLEKp

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3460 1380 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5024 wrote to memory of 1380	5024	rundll32.exe	rundll32.exe
PID 5024 wrote to memory of 1380	5024	rundll32.exe	rundll32.exe
PID 5024 wrote to memory of 1380	5024	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintcver.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5024

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintcver.dll,#1
2⤵
PID:1380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 620
3⤵
- Program crash
PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1380 -ip 1380
1⤵
PID:2512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1380-132-0x0000000000000000-mapping.dmp

Download
memory/1380-133-0x0000000074C10000-0x0000000074C55000-memory.dmp

Filesize
276KB

Download