d1505a8ac2409207637b344848d53a2e189a04873ebc87ac3155f7cd05b0e348

Analysis

max time kernel
41s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 20:52

Target

hintdm.dll
Size

218KB
MD5

bcda7604a68ad5061daf9cfb38fa0300
SHA1

d85930ef910a5f74d16eb2e308c5a2550bdf19d3
SHA256

74b0f7a9d2225d4d8580d801957d05b8229d5e8098327772150ea071ecc9ea36
SHA512

796a60a937651efbbd6ca30fcb916177f0bf594343a8a8f2a3efbe47f791f5145c2844e3adeb6248c26fc1173f843902bc82993fc6a535d57d838bc211ad3a36
SSDEEP

3072:4qP97WTO5gUYWT+wE80CrzgMz10fjgPPLZcpLg2Ra7mxxTIik9glk7JRBD2t+qG2:VWTOq9WTj/n08Pzyq9mxVIz9FzI+a

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1744 wrote to memory of 1696	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 1696	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 1696	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 1696	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 1696	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 1696	1744	rundll32.exe	rundll32.exe
PID 1744 wrote to memory of 1696	1744	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintdm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintdm.dll,#1
2⤵
PID:1696

memory/1696-54-0x0000000000000000-mapping.dmp

Download
memory/1696-55-0x0000000075A31000-0x0000000075A33000-memory.dmp

Filesize
8KB

Download