871761e2556c306e5507c278fee29c3f507d4eb0efac36cb98dc432daa15784f | Triage

Resubmissions

23-04-2023 17:07

230423-vm2waagc9v 7

23-04-2023 17:03

230423-vkr83aeg34 7

23-04-2023 16:56

230423-vf3h8sef88 7

Analysis

max time kernel
24s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23-04-2023 17:07

Sharing

Report Analysis Logs

General

Target

Hexa v1.5/Hexa/Hexal.dll
Size

3.7MB
MD5

e85fedf3928c13d5a919496a4ba2a4db
SHA1

d89f8e39e7acfd63ca1e014c6c26aa159669a824
SHA256

64a2a4edaaa4a1018b9897a48cbbc2c488f253fb4482ba7e7e55b83c9bd8ff7d
SHA512

1810cff90767d15244c16c14d2e50c1fcdc6e4dfcffa8ae7f9d132df7dc229cc6cc380ebb1b3d1a7b897980a9513c25a32d626fd719f9bc947531d72faca049a
SSDEEP

98304:4npYPEZDnDDMfUF+G/d0cYVUTkq3Lzl+vk8mxQfq:2pN/DMUFdd0cYVUT33LzIvdbfq

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1036	2032	rundll32.exe	27
PID 2032 wrote to memory of 1036	2032	rundll32.exe	27
PID 2032 wrote to memory of 1036	2032	rundll32.exe	27
PID 2032 wrote to memory of 1036	2032	rundll32.exe	27
PID 2032 wrote to memory of 1036	2032	rundll32.exe	27
PID 2032 wrote to memory of 1036	2032	rundll32.exe	27
PID 2032 wrote to memory of 1036	2032	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Hexa v1.5\Hexa\Hexal.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Hexa v1.5\Hexa\Hexal.dll",#1
  2⤵
  PID:1036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads