8b9977c66c0057b1629e024b68dc609db2b3287b975941b9aa2f3eed0a435c5d | Triage

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 12:10

Sharing

Report Analysis Logs

General

Target

hyperterminal/hypertrm.dll
Size

345KB
MD5

5de47dd21713621811fbd32a3a74cd08
SHA1

1bce1f5015ef0eaa310037c608dd0fb47a3686f5
SHA256

b21ec4455ea6e6cf6689b2bdd4fcb1ddec25850ab9c2811995f342bb180a8f2d
SHA512

12263dcf1195ed02d4253f0ab768282a2a24258cdb99439fa3ddd7083b45064c51b69fdd7106984be0cbd8dccd3fd5f2666566d3264dc71e992514aa475c7fdf
SSDEEP

6144:bVtP/gADfQPOzjxejKAsAC8kQW//8984Mb2:vPX9zleYV/L

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 280 wrote to memory of 488	280	rundll32.exe	28
PID 280 wrote to memory of 488	280	rundll32.exe	28
PID 280 wrote to memory of 488	280	rundll32.exe	28
PID 280 wrote to memory of 488	280	rundll32.exe	28
PID 280 wrote to memory of 488	280	rundll32.exe	28
PID 280 wrote to memory of 488	280	rundll32.exe	28
PID 280 wrote to memory of 488	280	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hyperterminal\hypertrm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\hyperterminal\hypertrm.dll,#1
  2⤵
  PID:488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads