2dc4c306da01adebbc2304f3d82d009bc3ca4a097209e4f6dd5400ef4f93cbc8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 04:54

Target

HShield/Update/ahni2.dll
Size

101KB
MD5

23187295212c07d4af7313e11d9cd1d5
SHA1

a73a25efcd997536533a33b622cbcd5de9023b20
SHA256

1752c61082f1eafbec5f3246747d848bef4136aef0ffdab319fe277451c18c28
SHA512

d2cdcd3e591118b979d4ff37ab4c5f825a0ce096bad459e858b0b49ffb1d3d10e6acea75f1087ce6d711fa0821e3513c4bb7b6566115cfc878a27191ae17e264
SSDEEP

3072:xRnFuJ04U4Z4B4Z4T4Z4B4Z4tA4/S4s4Z4h4Z4j4Z4h4Z4NQ4vLKRDVQei2qDz0/:5uJ0/MssCMssrdPs8Mys8MbfJ9001svV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2548 wrote to memory of 4204	2548	rundll32.exe	rundll32.exe
PID 2548 wrote to memory of 4204	2548	rundll32.exe	rundll32.exe
PID 2548 wrote to memory of 4204	2548	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HShield\Update\ahni2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HShield\Update\ahni2.dll,#1
  2⤵
  PID:4204