885ada1f9058f05120771460687807b13b162b8d8eeaf82bd68493fc4136aa4f | Triage

Analysis

max time kernel
136s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

HCPreview.dll
Size

615KB
MD5

2d30b10990471218c2ebed0e8de00396
SHA1

332c329bef70840dc3879681add2ea63af557ab7
SHA256

885ada1f9058f05120771460687807b13b162b8d8eeaf82bd68493fc4136aa4f
SHA512

832f19890484e7b150d72f2ca721349a32f108f5c3441c173eeeb2bc3a330fc872df3678f4ef964281f990a9e5c0939ac4b3bd07720c32cf2dfdc63976aee0ac
SSDEEP

12288:yqjvrGY4zzIioVtyqjpFGqTdVUXkb6Optjn7QV5sOzHVr:yEixzzIljpN7Tb6OptjnsoOz1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 116	2384	rundll32.exe	83
PID 2384 wrote to memory of 116	2384	rundll32.exe	83
PID 2384 wrote to memory of 116	2384	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HCPreview.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HCPreview.dll,#1
  2⤵
  PID:116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads