34c35e5e18354f9e459e792a3f8bb40af5b18787f0461078ba563b5d49aa6292 | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 22:32

Sharing

Report Analysis Logs

General

Target

Clanwar1.0/HFAuthShell.dll
Size

661KB
MD5

cdec7fc66182fd8d10694927df8d0e0b
SHA1

54b68476879ed6423b13f8e6f2e70e1af8b830c3
SHA256

09ae623fdaec6766dd68ac5550e768684eb2fb62a531720d5803a3b9a7dad5bf
SHA512

c736305be00d5aaef8c7d18b7e19fb0ac0a3930d17041add37526232a9380209e3c46d0893385c1b46268d074f3548210128e49a85586d07a4212885d9aebb48
SSDEEP

12288:7Fy/DhjgyxWP3VLDzEcjWuMk/CdIW8mjF06fdcok:Jy/DhVxy3RNW8mjF0Ecj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 284	1544	rundll32.exe	31
PID 1544 wrote to memory of 284	1544	rundll32.exe	31
PID 1544 wrote to memory of 284	1544	rundll32.exe	31
PID 1544 wrote to memory of 284	1544	rundll32.exe	31
PID 1544 wrote to memory of 284	1544	rundll32.exe	31
PID 1544 wrote to memory of 284	1544	rundll32.exe	31
PID 1544 wrote to memory of 284	1544	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Clanwar1.0\HFAuthShell.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Clanwar1.0\HFAuthShell.dll,#1
  2⤵
  PID:284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads