09643633731242877000c5de3c2a33ee66f36056005fe7e307a996bdef1d0de3

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2023 17:06

Target

HCNetSDKCom/HCGeneralCfgMgr.dll
Size

932KB
MD5

1c4948713f876e0cebcc1fa268ae8ed0
SHA1

0efc5430336f5bfd596bb302de230b75985fcb6c
SHA256

a8747715290c70410e3afc62ffd21ee26c0e053510853f4efad0bd3b15ded5d1
SHA512

98a580b5e869e8fefb96b7b1d597ebdba7b847509b1c4421b53466dd118728f73ee16eab0995e1989cf707ac9901bece3d980404886b0d1c1163df73ecdc851a
SSDEEP

12288:kqywClV0ilj+FsrdARvQgV5yShGtuOSP4bBiiY3Tj5rHg++Tr67AkujBrnqpwsu+:tjKlj+FSgV0U5rHg1NUgM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3524 wrote to memory of 3668	3524	rundll32.exe	rundll32.exe
PID 3524 wrote to memory of 3668	3524	rundll32.exe	rundll32.exe
PID 3524 wrote to memory of 3668	3524	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HCNetSDKCom\HCGeneralCfgMgr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3524

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HCNetSDKCom\HCGeneralCfgMgr.dll,#1
2⤵
PID:3668