8b9977c66c0057b1629e024b68dc609db2b3287b975941b9aa2f3eed0a435c5d | Triage

Analysis

max time kernel
137s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 12:10

Sharing

Report Analysis Logs

General

Target

hyperterminal/hticons.dll
Size

43KB
MD5

a6a1665e1b5a77cd543e696242c706c2
SHA1

5a8660772cb7383de353a7009e3f665cb990488f
SHA256

01b4a04c491b8f94fd066ccc5b812034e7932c6b23e39cd8e695875016031fa1
SHA512

420561fb39ad62b6c063829a0cf783b63ea9a1274511d185222ad1e166f7c4903117a402992728eb6c3c3a3cf7bd957ca3a3daac9c4c5e179aa6cf5e3c2bf479
SSDEEP

768:YrXNDN3n3DRz6cgGwLOG9GnF4NrIMWG5ErjS2HjIRENr:YrXlNXzADnafFkWGq6cjTNr

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 4760	3212	rundll32.exe	88
PID 3212 wrote to memory of 4760	3212	rundll32.exe	88
PID 3212 wrote to memory of 4760	3212	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hyperterminal\hticons.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\hyperterminal\hticons.dll,#1
  2⤵
  PID:4760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads