09643633731242877000c5de3c2a33ee66f36056005fe7e307a996bdef1d0de3

Analysis

max time kernel
138s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2023 17:06

Target

HCNetSDKCom/HCIndustry.dll
Size

520KB
MD5

66b0d0bd5c66d58d366042d1530152fe
SHA1

d071eb65c3b307fbd33daabd6e018f5f23c482ff
SHA256

ebf9ea1ef2a522341c498c1b3ad5e162da84cb658ce25ef6377a75a848338561
SHA512

0288571517f6f2049a5bf7905e1f78a44b9aa27f5186f6b166f6a6d5f8fab06c0ff811df6c67736dcdd9f91b96aa43efa62ec106f45c13c816aff4482ba444c1
SSDEEP

6144:LDa7E/+ScmPQ7ZS4s3CFA6feS+1zn9hQ6s1d3nr//WnV0/ciy/3ttZWT7:LQscmQKZ6feS+19hQ6sn3nr/eWcET7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 208 wrote to memory of 4164	208	rundll32.exe	rundll32.exe
PID 208 wrote to memory of 4164	208	rundll32.exe	rundll32.exe
PID 208 wrote to memory of 4164	208	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HCNetSDKCom\HCIndustry.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:208

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HCNetSDKCom\HCIndustry.dll,#1
2⤵
PID:4164