5f09de90db804401842617dddb5750c6a8d7a27edb409c91f2ef86d0198d3e58 | Triage

Analysis

max time kernel
66s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 05:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dhnetsdk.dll
Size

872KB
MD5

58aa81962eb33c0bae91663559c7aee9
SHA1

2ca99598b0762024b7d2f88be5cba936715464a2
SHA256

5ee2b71ddb06d1c11e3e503a49168e71c04d7255e12d7670b3d0f6d9333e1229
SHA512

0f437be665ea536506295edecbc8a686458de1581bdca59378e96d6d2667a507207c942ae07ac882d6e003621f1cb6255cd77cf091036807a582c2c6d2e0ce7b
SSDEEP

24576:JS1MBVw/iOcVZBW2vuPm/dH1Vt9YMggNfu:DwxS8c/91Vt9YFAf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 3368	2252	rundll32.exe	83
PID 2252 wrote to memory of 3368	2252	rundll32.exe	83
PID 2252 wrote to memory of 3368	2252	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dhnetsdk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dhnetsdk.dll,#1
  2⤵
  PID:3368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3368-0-0x00000000036A0000-0x00000000036F8000-memory.dmp

Filesize
352KB

Download