87e2f95b873020d7d15ece6f5d2a2be539415997413ff45a51b23d0cef197e4c | Triage

Analysis

max time kernel
28s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02/05/2023, 00:37

Sharing

Report Analysis Logs

General

Target

Widescreen HOR+ Support by Wesser/wshps.dll
Size

127KB
MD5

79d931ee3cfbe84b9025ce0c0e8cf744
SHA1

0b997a1f407cb3aa55cdd5206cbb3692d48accaa
SHA256

09d0c3f9d6e2619d85efe87b9a8564abecfa83526c39a8dd75933c2461b02075
SHA512

a2aa1903f3cfdab5f19120b185a000eacf6f58f54c820849e62cc55f4844257b57fe85d671ace7241e3539d46e35be96e7be85593c588b6b66ad3af0013c148e
SSDEEP

3072:y0vitq6mKOmfhcH6TpXTpqvpXB15/2Bb:y0viFOmpcH6B2xM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1992	1980	rundll32.exe	27
PID 1980 wrote to memory of 1992	1980	rundll32.exe	27
PID 1980 wrote to memory of 1992	1980	rundll32.exe	27
PID 1980 wrote to memory of 1992	1980	rundll32.exe	27
PID 1980 wrote to memory of 1992	1980	rundll32.exe	27
PID 1980 wrote to memory of 1992	1980	rundll32.exe	27
PID 1980 wrote to memory of 1992	1980	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Widescreen HOR+ Support by Wesser\wshps.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Widescreen HOR+ Support by Wesser\wshps.dll",#1
  2⤵
  PID:1992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads