5f09de90db804401842617dddb5750c6a8d7a27edb409c91f2ef86d0198d3e58 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 05:43

Sharing

Report Analysis Logs

General

Target

dhnetsdk.dll
Size

872KB
MD5

58aa81962eb33c0bae91663559c7aee9
SHA1

2ca99598b0762024b7d2f88be5cba936715464a2
SHA256

5ee2b71ddb06d1c11e3e503a49168e71c04d7255e12d7670b3d0f6d9333e1229
SHA512

0f437be665ea536506295edecbc8a686458de1581bdca59378e96d6d2667a507207c942ae07ac882d6e003621f1cb6255cd77cf091036807a582c2c6d2e0ce7b
SSDEEP

24576:JS1MBVw/iOcVZBW2vuPm/dH1Vt9YMggNfu:DwxS8c/91Vt9YFAf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2400	2416	rundll32.exe	28
PID 2416 wrote to memory of 2400	2416	rundll32.exe	28
PID 2416 wrote to memory of 2400	2416	rundll32.exe	28
PID 2416 wrote to memory of 2400	2416	rundll32.exe	28
PID 2416 wrote to memory of 2400	2416	rundll32.exe	28
PID 2416 wrote to memory of 2400	2416	rundll32.exe	28
PID 2416 wrote to memory of 2400	2416	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dhnetsdk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dhnetsdk.dll,#1
  2⤵
  PID:2400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2400-0-0x00000000031E0000-0x0000000003238000-memory.dmp

Filesize
352KB

Download