f4665a7274e113691256ab2e8d894098a5861558492ad71ee76544d029a172c1 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:54

Sharing

Report Analysis Logs

General

Target

dhplay.dll
Size

368KB
MD5

1241168449249747315fec232edfd70a
SHA1

e51b3ae55a067b31f0c4c453ac04a8d3d6aa5ea6
SHA256

c0b3c4463a09d4d22f8ef812005a0b44774b758e774e64f71729c2624bdcee20
SHA512

6cb905fbeb6a4c4da5c4b240275a8d677c6ea3a039b128fd2fecbafbbad297445c71871c1b8e80dd1115fccc0f875bda3e9a279978f4d86edd0c711bad3a7dbb
SSDEEP

6144:0M2aWhVxQZKvInGSz3eogngODTjgD3e1Iqfeb5et:LQ6zGSzqndgD3Lq3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1660 wrote to memory of 1988	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 1988	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 1988	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 1988	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 1988	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 1988	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 1988	1660	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dhplay.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dhplay.dll,#1
2⤵
PID:1988

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...