f4665a7274e113691256ab2e8d894098a5861558492ad71ee76544d029a172c1 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:54

Sharing

Report Analysis Logs

General

Target

DHSurveillanceDll.dll
Size

532KB
MD5

4d36e3ababb027e86032a54a532f1b98
SHA1

838b560af62c299ee423145609a41778fb326483
SHA256

4dc1d037066702597279695eccc6eba746650ffce9fc0f7d66b4a1bb67f93880
SHA512

84e66f2dc3066851196a02f3397eed82c2a159c063a1d34cd63a4e31eca3eb54f28de7f625b002dbe68a0bc0a7fd0331ec5fb1147123227da79fb21302112369
SSDEEP

12288:/szPp6OLmAmAxxbartNomeUk1ZSIT6ThiCd:/sDp6wmMxxbart2meUkM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2156 wrote to memory of 2964	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 2964	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 2964	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 2964	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 2964	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 2964	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 2964	2156	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DHSurveillanceDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DHSurveillanceDll.dll,#1
2⤵
PID:2964

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2964-0-0x00000000006C0000-0x000000000079D000-memory.dmp

Filesize
884KB

Download