09643633731242877000c5de3c2a33ee66f36056005fe7e307a996bdef1d0de3 | Triage

Analysis

max time kernel
264s
max time network
318s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14-10-2023 17:06

Sharing

Report Analysis Logs

General

Target

HCNetSDKCom/HCPreview.dll
Size

448KB
MD5

9fb6bbc9732660902d1dbd91c432a482
SHA1

7a46e54108bb6aa9d35435755a11c381e47bab87
SHA256

91f63aac8b851ad71a5d8d094f038414f07b3bbe1779b738f91c6c210e7f2015
SHA512

2c48cf147b412b802bc096721590617fcccc339e5429c7b6f2d54f44ad0f1a172a51ddfe1c26a0ecc732739aa97f74ab3bbc99fe6f0437ed15fd36180e3e89be
SSDEEP

6144:tUOcO18pZnVUR7cLlBG4pN6Nur8ugW1RIEUXc0FBi:pco2ZaRILvpNaur8ugHXc0FQ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2520 wrote to memory of 2544	2520	rundll32.exe	rundll32.exe
PID 2520 wrote to memory of 2544	2520	rundll32.exe	rundll32.exe
PID 2520 wrote to memory of 2544	2520	rundll32.exe	rundll32.exe
PID 2520 wrote to memory of 2544	2520	rundll32.exe	rundll32.exe
PID 2520 wrote to memory of 2544	2520	rundll32.exe	rundll32.exe
PID 2520 wrote to memory of 2544	2520	rundll32.exe	rundll32.exe
PID 2520 wrote to memory of 2544	2520	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HCNetSDKCom\HCPreview.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2520

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HCNetSDKCom\HCPreview.dll,#1
2⤵
PID:2544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads