dbb53b0f2c9c2a6af84fb791a00540f9af056474ac067579440c80912b8f2e50 | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 20:14

Sharing

Report Analysis Logs

General

Target

HaoZipShell.dll
Size

115KB
MD5

e58565d563b57d23cabf53ab07dd1a48
SHA1

47875e0b3399eb6bbac4d6d8d7ee7dd449aa0b09
SHA256

ac0b28a399cec5081349cb1ab36b76cb7e0705a51ed14e4029b63ce7e63181b0
SHA512

69aa599a6e9830a2264abb34566181789eb6b3980f938c58d94f3da460765c854ce5e4c99b49aa4a2fa372e6360154839a391a9adc5ac31635315e16c4131c22
SSDEEP

3072:JVWBm9F4v+mKUIdcrJl5Ows2j6FBZVKWiq8EkODXjwMXa:JVMmz4vAldcPZXOBfK79EkODX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 2360	1360	rundll32.exe	88
PID 1360 wrote to memory of 2360	1360	rundll32.exe	88
PID 1360 wrote to memory of 2360	1360	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HaoZipShell.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HaoZipShell.dll,#1
  2⤵
  PID:2360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads