f4665a7274e113691256ab2e8d894098a5861558492ad71ee76544d029a172c1 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:54

Sharing

Report Analysis Logs

General

Target

dhnetsdk.dll
Size

876KB
MD5

db2886ed534f69b78fc52935cc02ffdd
SHA1

63fc5a9c8c418c9634f7fa532868315076113401
SHA256

4727813be01de388afac72d75ace3ff77df1524e79348c69ac170516bfbb43ab
SHA512

63e838465a389d8bd21b541940d67d3e87eac29eecb3bca137bbca9352723f19d2c1f5484e89474ae017129377e2a32d2166097fe06b60ebe363d50f52c4a81c
SSDEEP

12288:+7CQeSGhqsem3nWocWi/pFSj3IsIJepD1cb3W2qAph/NcxuITu2j:+G7SQD3nWWcgjFIJeN2W2Np9iXu

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\sdk_log\sdk_log.log rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2128 wrote to memory of 1692	2128	rundll32.exe	rundll32.exe
PID 2128 wrote to memory of 1692	2128	rundll32.exe	rundll32.exe
PID 2128 wrote to memory of 1692	2128	rundll32.exe	rundll32.exe
PID 2128 wrote to memory of 1692	2128	rundll32.exe	rundll32.exe
PID 2128 wrote to memory of 1692	2128	rundll32.exe	rundll32.exe
PID 2128 wrote to memory of 1692	2128	rundll32.exe	rundll32.exe
PID 2128 wrote to memory of 1692	2128	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dhnetsdk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2128

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dhnetsdk.dll,#1
2⤵
- Drops file in System32 directory
PID:1692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1692-0-0x0000000002DD0000-0x0000000002E4E000-memory.dmp

Filesize
504KB

Download