f4665a7274e113691256ab2e8d894098a5861558492ad71ee76544d029a172c1 | Triage

Analysis

max time kernel
133s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:54

Sharing

Report Analysis Logs

General

Target

dhnetsdk.dll
Size

876KB
MD5

db2886ed534f69b78fc52935cc02ffdd
SHA1

63fc5a9c8c418c9634f7fa532868315076113401
SHA256

4727813be01de388afac72d75ace3ff77df1524e79348c69ac170516bfbb43ab
SHA512

63e838465a389d8bd21b541940d67d3e87eac29eecb3bca137bbca9352723f19d2c1f5484e89474ae017129377e2a32d2166097fe06b60ebe363d50f52c4a81c
SSDEEP

12288:+7CQeSGhqsem3nWocWi/pFSj3IsIJepD1cb3W2qAph/NcxuITu2j:+G7SQD3nWWcgjFIJeN2W2Np9iXu

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\sdk_log\sdk_log.log rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4804 wrote to memory of 4424	4804	rundll32.exe	rundll32.exe
PID 4804 wrote to memory of 4424	4804	rundll32.exe	rundll32.exe
PID 4804 wrote to memory of 4424	4804	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dhnetsdk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4804

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dhnetsdk.dll,#1
2⤵
- Drops file in System32 directory
PID:4424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4424-0-0x0000000003910000-0x000000000398E000-memory.dmp

Filesize
504KB

Download