f271c8f134130fbfe0655f50ebf35d421d0dde39371d8f89816e736e447f5689

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 16:51

Target
MHPT v7.dll
Size 7KB
Sample240306-vcx5cach37
SHA256 1a8e59105734c4f157b07c16b4f3cf08e1c5a83554b5e76ed7257544a4aec2a4
MD5 b4cbe3a1aaaf0647b101f3eea0704ab5
SHA1 5f772764f18a3a96e6a81ebd75c741a7ad263ff9
SHA512 c4a319d29520fd6145fa4f591792c4e4ecf97f2e7f8c986273f2545163b7c59910c4802fa24032560c01abd0d5599205bda9ca3cf72a522c14c249fe69d747e3
SSDEEP 192:I0nPXNWAxgwCMrpY7S8LqPZo5LdCfuR1nuO3:IDAxgr6+S9Pfu7n5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2820	2352	rundll32.exe	28
PID 2352 wrote to memory of 2820	2352	rundll32.exe	28
PID 2352 wrote to memory of 2820	2352	rundll32.exe	28
PID 2352 wrote to memory of 2820	2352	rundll32.exe	28
PID 2352 wrote to memory of 2820	2352	rundll32.exe	28
PID 2352 wrote to memory of 2820	2352	rundll32.exe	28
PID 2352 wrote to memory of 2820	2352	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MHPT v7.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MHPT v7.dll",#1
  2⤵
  PID:2820

memory/2820-0-0x0000000010000000-0x0000000010008000-memory.dmp

Download

memory/2820-1-0x0000000010000000-0x0000000010008000-memory.dmp

Download

memory/2820-2-0x0000000010000000-0x0000000010008000-memory.dmp

Download