609cccd44a03bfd93cef765de354cdb2d3b847d90bc4dca0116ace0b1cfb1bc7

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 16:58

Target

HRSword x64/daemon.dll
Size

411KB
MD5

0a5953205c4d824cca92870707e568e9
SHA1

109afdffb6e4f6ebd5549ae36ffc4c91ab1429a8
SHA256

ac9eda0ff6dbe0d5868afa0a14dcb9a10379eb042f5b09749c4dcfb36c4dc0ba
SHA512

47f2c7532b5c4f5aa25c28da7bef32bff031e655ea75dfc6555b2c4585704cdcf1d3db29f543d8437906cfea722af0ee56767f27dd213d230da95997f2f1d051
SSDEEP

12288:C4jNg/cV4lMXjcRszkOAnKu3/kPCd3WnmlVnmSiRlTMve5n3sFoWQA:C4jNg/cVWMXIyoOKWnmlVnmSulTMhFoI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2924	3048	rundll32.exe	28
PID 3048 wrote to memory of 2924	3048	rundll32.exe	28
PID 3048 wrote to memory of 2924	3048	rundll32.exe	28
PID 3048 wrote to memory of 2924	3048	rundll32.exe	28
PID 3048 wrote to memory of 2924	3048	rundll32.exe	28
PID 3048 wrote to memory of 2924	3048	rundll32.exe	28
PID 3048 wrote to memory of 2924	3048	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\HRSword x64\daemon.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\HRSword x64\daemon.dll",#1
  2⤵
  PID:2924