2dc4c306da01adebbc2304f3d82d009bc3ca4a097209e4f6dd5400ef4f93cbc8

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 04:54

Target

HShield/Update/v3bz32.dll
Size

61KB
MD5

09085376e57c6fa38544a5a2207a03cb
SHA1

2e508e210a97b90038e5edc184b0fca6f5b9570e
SHA256

bd84a8d7193cd98e99e4b5b310ad65e5cd860b717c40183edbaf7bd8cb852c70
SHA512

3085ae71253dcc457ae87aebbb30ea41b50fbd51c6bdbe7d08bbd63b05d615f1e1af126f4754d15dbce44e7818d691ea3fb28329cd364a2dcca0c69fc79c5cff
SSDEEP

768:sgj8H3BwGnjmBJapFwDFycXMukszBGUQ2l/F23AakZ1Grd5hjfOCrU/Lnzhj5L39:bjo/naaTc8vgGU3N88ZkB51OBnz15

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1588	2196	rundll32.exe	28
PID 2196 wrote to memory of 1588	2196	rundll32.exe	28
PID 2196 wrote to memory of 1588	2196	rundll32.exe	28
PID 2196 wrote to memory of 1588	2196	rundll32.exe	28
PID 2196 wrote to memory of 1588	2196	rundll32.exe	28
PID 2196 wrote to memory of 1588	2196	rundll32.exe	28
PID 2196 wrote to memory of 1588	2196	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HShield\Update\v3bz32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HShield\Update\v3bz32.dll,#1
  2⤵
  PID:1588