ccd1435a4f112cd6b28dd4351622db674c7dca64e3e7875bb1db36f3763e35ed | Triage

Analysis

max time kernel
28s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12-04-2023 19:52

Sharing

Report Analysis Logs

General

Target

Plugins/32bit/HWiNFO.dll
Size

121KB
MD5

59c3201f1318261e70bbe1b21a3cb6e8
SHA1

714b358c8a8411430159017b9c77c6105802f699
SHA256

bfdfae26184f04b1d109bd17a6b9bf0d92ca72bc3e276857616d44cef43a894e
SHA512

b5576dbc9476d5572773e027d634bc54191dd3f190744dcfd3925ebb1b9da22449f56479023f2f53d4e9daa82ff91e31affaf49beb13ede1fa60c0e94357a184
SSDEEP

3072:u8tDsBj6K5f/UcvOYqd1eR1uDYIFtHeIY7mDT:3Af/UcS1eesaeIYW

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 1256	1248	rundll32.exe	28
PID 1248 wrote to memory of 1256	1248	rundll32.exe	28
PID 1248 wrote to memory of 1256	1248	rundll32.exe	28
PID 1248 wrote to memory of 1256	1248	rundll32.exe	28
PID 1248 wrote to memory of 1256	1248	rundll32.exe	28
PID 1248 wrote to memory of 1256	1248	rundll32.exe	28
PID 1248 wrote to memory of 1256	1248	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\32bit\HWiNFO.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\32bit\HWiNFO.dll,#1
  2⤵
  PID:1256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads