09643633731242877000c5de3c2a33ee66f36056005fe7e307a996bdef1d0de3

Analysis

max time kernel
156s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2023 17:06

Target

HCNetSDKCom/AudioIntercom.dll
Size

439KB
MD5

50f700d0306cceaf132e6b176bc081b3
SHA1

9341d144f0ae801775acbf1ed7a09c378d1f9b14
SHA256

5f7623fdc0c9592a5f4fd39ae639bfef27edd18141541a3bff0aa6d67763e5cb
SHA512

21f371b47bbac6c0394c182ded41562c14e42a9699798689e53249c304e62333776c92bd5e0f90f911fa9ba1aa50c4a524cf2ad13a4e256e5d1836ea06470f05
SSDEEP

6144:B75TYr6sBgAwl03uMYCh9J5YuX6p7gAwVA/rszRXF0FiGAn42utSgsVrG:5mgC3ZYCh9J5Y487g3AjoRXMH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1372 wrote to memory of 4764	1372	rundll32.exe	rundll32.exe
PID 1372 wrote to memory of 4764	1372	rundll32.exe	rundll32.exe
PID 1372 wrote to memory of 4764	1372	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HCNetSDKCom\AudioIntercom.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1372

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HCNetSDKCom\AudioIntercom.dll,#1
2⤵
PID:4764