2dc4c306da01adebbc2304f3d82d009bc3ca4a097209e4f6dd5400ef4f93cbc8 | Triage

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 04:54

Sharing

Report Analysis Logs

General

Target

HShield/Update/ahnupctl.dll
Size

149KB
MD5

f3fca50302c5fc4ca0e0ef1c13e41d02
SHA1

3e0a77f1c1b5bbac54c3da6331d229c18b97f794
SHA256

309f724ab4cbfbafb9210a0c7ca317fdf751582e9c2acff48cf1b26ac8f23f18
SHA512

62fe3ac6ebafd34175b0e133fcf9689dae68d693a865c11582300c783f0ab43b19feabaec68371c0634560bb44987a1b2381595dc7de3ffc99a39ef3653cbb93
SSDEEP

3072:Y4217sdgYA6m/lPNIClh8vfJIHrBtZgJblg5Wb981bJ:L2dsdQ6ojFlmvfJIVvMbaP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2472 wrote to memory of 4428	2472	rundll32.exe	rundll32.exe
PID 2472 wrote to memory of 4428	2472	rundll32.exe	rundll32.exe
PID 2472 wrote to memory of 4428	2472	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HShield\Update\ahnupctl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HShield\Update\ahnupctl.dll,#1
  2⤵
  PID:4428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads