09643633731242877000c5de3c2a33ee66f36056005fe7e307a996bdef1d0de3

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14-10-2023 17:06

Target

HCNetSDKCom/HCAlarm.dll
Size

340KB
MD5

041dced0baf2f61c6246ee3699b1aa32
SHA1

9d991fc8de0d4f2c0d4dda3b4ae60431c3cf579e
SHA256

16258b1d243020de7de6bdc13c471dfa91cdf88b41d929f8fd15827d890bda3a
SHA512

003961aa0ba74b815b060970e0bff8618b0b2a7ed47888182e1727b49bb72b974d4f2c95376657a6ac883da9670b4714cc07bac30f2ec2374be90a081619ed87
SSDEEP

3072:vN9gfmGJ8Ra9sSh0HakFUbzDZJe6Y1RJw5OWHACi72WqSenXZPf5nhiLiNR0u4fN:V9gO6sVFI9HdFSenJPfX0bTTQbm

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2988 wrote to memory of 1896	2988	rundll32.exe	rundll32.exe
PID 2988 wrote to memory of 1896	2988	rundll32.exe	rundll32.exe
PID 2988 wrote to memory of 1896	2988	rundll32.exe	rundll32.exe
PID 2988 wrote to memory of 1896	2988	rundll32.exe	rundll32.exe
PID 2988 wrote to memory of 1896	2988	rundll32.exe	rundll32.exe
PID 2988 wrote to memory of 1896	2988	rundll32.exe	rundll32.exe
PID 2988 wrote to memory of 1896	2988	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HCNetSDKCom\HCAlarm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HCNetSDKCom\HCAlarm.dll,#1
2⤵
PID:1896