885ada1f9058f05120771460687807b13b162b8d8eeaf82bd68493fc4136aa4f | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 14:20

Sharing

Report Analysis Logs

General

Target

HCPreview.dll
Size

615KB
MD5

2d30b10990471218c2ebed0e8de00396
SHA1

332c329bef70840dc3879681add2ea63af557ab7
SHA256

885ada1f9058f05120771460687807b13b162b8d8eeaf82bd68493fc4136aa4f
SHA512

832f19890484e7b150d72f2ca721349a32f108f5c3441c173eeeb2bc3a330fc872df3678f4ef964281f990a9e5c0939ac4b3bd07720c32cf2dfdc63976aee0ac
SSDEEP

12288:yqjvrGY4zzIioVtyqjpFGqTdVUXkb6Optjn7QV5sOzHVr:yEixzzIljpN7Tb6OptjnsoOz1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2868	2852	rundll32.exe	28
PID 2852 wrote to memory of 2868	2852	rundll32.exe	28
PID 2852 wrote to memory of 2868	2852	rundll32.exe	28
PID 2852 wrote to memory of 2868	2852	rundll32.exe	28
PID 2852 wrote to memory of 2868	2852	rundll32.exe	28
PID 2852 wrote to memory of 2868	2852	rundll32.exe	28
PID 2852 wrote to memory of 2868	2852	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HCPreview.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HCPreview.dll,#1
  2⤵
  PID:2868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads