09643633731242877000c5de3c2a33ee66f36056005fe7e307a996bdef1d0de3

Analysis

max time kernel
209s
max time network
279s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2023 17:06

Target

HCNetSDKCom/HCPlayBack.dll
Size

332KB
MD5

34e0e7c615ed589cc060224121df0174
SHA1

baf5e1e2d2a50a113f40218f9d14bf095870e66c
SHA256

f7865669d8214384570e4f59c0c2b7e37edc4e8ff8c855e4365cf9a89eebbc62
SHA512

659422021b6b1113e0eb03713e3d82ce9a91368314f2ee8ae3937d7f40dd04c7afaee188d029b8a5fd3a1fd2646ecc7959f477acc2a60febd3b126c5bb8104c2
SSDEEP

3072:nld732YbLYR740NysBg/yfJRJN3hQXtHakwh5nIgUxU0aCXn2JJaPxSGfvj5Ig0r:lx9bLU7UsBg/0R8RaRIgm3aCXG0bqym

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4140 wrote to memory of 4952	4140	rundll32.exe	rundll32.exe
PID 4140 wrote to memory of 4952	4140	rundll32.exe	rundll32.exe
PID 4140 wrote to memory of 4952	4140	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HCNetSDKCom\HCPlayBack.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4140

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HCNetSDKCom\HCPlayBack.dll,#1
2⤵
PID:4952