09643633731242877000c5de3c2a33ee66f36056005fe7e307a996bdef1d0de3 | Triage

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2023 17:06

Sharing

Report Analysis Logs

General

Target

DahuaHCNetSDK.dll
Size

6.2MB
MD5

62dc08e26b647a5513a7adc6251a5843
SHA1

ba4a57d013e7fa142005358db671abfe3674107f
SHA256

a1d7bc961677b86bafea2ff6942a378aa01e4f481f273e866e9b8bb525a9e3db
SHA512

4a32cf821adc278c11662fdcc57129fb4413cad3c576bd2f5026342305b3cbf411b9c7146020458818ad8934e0c1c397bde56a0b49bddc608c35c2fa181a134d
SSDEEP

98304:4ed4iAun58wLHLMtNQPQf0x0bpEKowhjILgWooqikbUGlSX2kwu/lKm7:nKiAu3tooIUGlSX2kwu/x7

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\sdk_log\sdk_log.log rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4940 wrote to memory of 3284	4940	rundll32.exe	rundll32.exe
PID 4940 wrote to memory of 3284	4940	rundll32.exe	rundll32.exe
PID 4940 wrote to memory of 3284	4940	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DahuaHCNetSDK.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4940

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DahuaHCNetSDK.dll,#1
2⤵
- Drops file in System32 directory
PID:3284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads