f9de69f500316f89884b9809943388ea1c7bab6e9164316f9e880e4bbc2fa469 | Triage

Analysis

max time kernel
118s
max time network
148s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:33

Sharing

Report Analysis Logs

General

Target

MiniUpdate/MHPClient.dll
Size

702KB
MD5

1f10c8008934c0cc2efd274d81fb5704
SHA1

0002902623d18154a3e3c59ef497378598c03bd3
SHA256

011e21d2084750a9c04693505127d9eb08ff7ac2b04dc20a2881b1b5912a1d3e
SHA512

c116a192a50d27c2dd87d6aa6bfe66e20b0bc629feaceec66c6c187397ab30ffdb0e2e3ecb96b015e899c0f86f7270517e6d24716a17a6ecfd0f2a72b14a6ced
SSDEEP

6144:hG1kLvclLmFFWr+YOZQSYyVZ+vKD0fWQ8E6C4XIkWy7pZGx:SkLvcliFF2+OyHDwWQ8VX/v4x

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2812 wrote to memory of 2720	2812	rundll32.exe	29
PID 2812 wrote to memory of 2720	2812	rundll32.exe	29
PID 2812 wrote to memory of 2720	2812	rundll32.exe	29
PID 2812 wrote to memory of 2720	2812	rundll32.exe	29
PID 2812 wrote to memory of 2720	2812	rundll32.exe	29
PID 2812 wrote to memory of 2720	2812	rundll32.exe	29
PID 2812 wrote to memory of 2720	2812	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MiniUpdate\MHPClient.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MiniUpdate\MHPClient.dll,#1
  2⤵
  PID:2720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads