8b9977c66c0057b1629e024b68dc609db2b3287b975941b9aa2f3eed0a435c5d | Triage

Analysis

max time kernel
121s
max time network
141s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 12:10

Sharing

Report Analysis Logs

General

Target

hyperterminal/hticons.dll
Size

43KB
MD5

a6a1665e1b5a77cd543e696242c706c2
SHA1

5a8660772cb7383de353a7009e3f665cb990488f
SHA256

01b4a04c491b8f94fd066ccc5b812034e7932c6b23e39cd8e695875016031fa1
SHA512

420561fb39ad62b6c063829a0cf783b63ea9a1274511d185222ad1e166f7c4903117a402992728eb6c3c3a3cf7bd957ca3a3daac9c4c5e179aa6cf5e3c2bf479
SSDEEP

768:YrXNDN3n3DRz6cgGwLOG9GnF4NrIMWG5ErjS2HjIRENr:YrXlNXzADnafFkWGq6cjTNr

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2332	2300	rundll32.exe	28
PID 2300 wrote to memory of 2332	2300	rundll32.exe	28
PID 2300 wrote to memory of 2332	2300	rundll32.exe	28
PID 2300 wrote to memory of 2332	2300	rundll32.exe	28
PID 2300 wrote to memory of 2332	2300	rundll32.exe	28
PID 2300 wrote to memory of 2332	2300	rundll32.exe	28
PID 2300 wrote to memory of 2332	2300	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hyperterminal\hticons.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\hyperterminal\hticons.dll,#1
  2⤵
  PID:2332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads