f9628c9278c1ae0e666ee3ddfda70614d6c22af1c6b70435f7d8b1651051f4f3 | Triage

Analysis

max time kernel
134s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 16:48

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/kyhrd.dll
Size

125KB
MD5

90de0d49e928a4199475d30b3a7a7a37
SHA1

777711d533adbada6413c27afdb83d027177e7ef
SHA256

20b4a909ae1f1b7be6f79deb355558bfcc923e9cb0fc59aa44d4f25f75fdacf8
SHA512

c5fb7116a55a238b397b88b881905bf31d13d48f3f43c1ef36194b88d5e2b6bcaf5eb205d71f458ce19c60f9b47929b8e3cdd17edc69f09d32e5f5d58d5b5bc4
SSDEEP

3072:EVAD45PtGJiMfPzmxjKKiwohpP0rD/vw+:EeDiQ/rmx1iwcxMD3w+

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 4992	4556	rundll32.exe	84
PID 4556 wrote to memory of 4992	4556	rundll32.exe	84
PID 4556 wrote to memory of 4992	4556	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\kyhrd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\kyhrd.dll,#1
  2⤵
  PID:4992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads