c71680c74cf84be6c4af31a16548ee1835f23c6e5e1d56668dac800137ad0b88 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 23:36

Sharing

Report Analysis Logs

General

Target

bin/11.0.264.0/HBLiteSAHook.dll
Size

146KB
MD5

7c7c8ccde8dbf3e9e7f314cfc25abe35
SHA1

b8f5d388048b34b6224365e1c042614889456703
SHA256

8a0e3d03f170648adca6f058ed026c3e890717a2d7b93969b0ea622bfa3aa038
SHA512

42965f0a45fd198b434a7f7add7b392ef647a349bb564f7ed0f4d7f55e0457c631c9ffd610c5de71d4abbd640756fd3ed02d2984764436e57baae8d7f8081487
SSDEEP

3072:Yxqe+1qMaH458Y22yBdtUiIBKSk05J5X/a:YDtrPiNV/a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 2180	1300	rundll32.exe	28
PID 1300 wrote to memory of 2180	1300	rundll32.exe	28
PID 1300 wrote to memory of 2180	1300	rundll32.exe	28
PID 1300 wrote to memory of 2180	1300	rundll32.exe	28
PID 1300 wrote to memory of 2180	1300	rundll32.exe	28
PID 1300 wrote to memory of 2180	1300	rundll32.exe	28
PID 1300 wrote to memory of 2180	1300	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\11.0.264.0\HBLiteSAHook.dll,#1
  2⤵
  PID:2180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads