34c35e5e18354f9e459e792a3f8bb40af5b18787f0461078ba563b5d49aa6292 | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 22:32

Sharing

Report Analysis Logs

General

Target

Clanwar1.0/HFDLMgr.dll
Size

64KB
MD5

8c95976cdeed8790227b2b8a40de9dde
SHA1

63a82fa76488e2d4c36e3dad63bdd1d2f7758c70
SHA256

b417df351ad5d04d5f0841326cd8e873875a1e3d2cf2fa715e0f598f43329510
SHA512

597e9da41aa631bd9ba86276b73334354cfef0da1d47db1e1c7a77f6b917280ad331e429879d79891beb7723af9101acf160cb559272d18b0bfbdcb4503e9fc0
SSDEEP

1536:Iv9drRButv1Ry7U+72tqbznhhKbiUOKHMQf:IVlutv1c7U+72tqbrhhKbpOKHM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 3024	2396	rundll32.exe	31
PID 2396 wrote to memory of 3024	2396	rundll32.exe	31
PID 2396 wrote to memory of 3024	2396	rundll32.exe	31
PID 2396 wrote to memory of 3024	2396	rundll32.exe	31
PID 2396 wrote to memory of 3024	2396	rundll32.exe	31
PID 2396 wrote to memory of 3024	2396	rundll32.exe	31
PID 2396 wrote to memory of 3024	2396	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Clanwar1.0\HFDLMgr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Clanwar1.0\HFDLMgr.dll,#1
  2⤵
  PID:3024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads