a9f2c4bc268765fc6d72d8e00363d2440cf1dcbd1ef7ee08978959fc118922c9 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-12-2024 01:28

Sharing

Report Analysis Logs

General

Target

HexaPort.dll
Size

514KB
MD5

2386ff4241e16fcca5481606a1424bf7
SHA1

f1d299336aac1a1314b36064ffa9ae12ebdb3e4c
SHA256

a9f2c4bc268765fc6d72d8e00363d2440cf1dcbd1ef7ee08978959fc118922c9
SHA512

5d31aec494217835d8da4c8b3b3a85c8aea148fa484ab2b348546154470aa96d64a205d4aa3909cc337b791a7daa2daea76a0c5b00660daef818e7883e078cdc
SSDEEP

12288:+lCodWFCE5bMQSuXYKwJCGZsv7y+eU6u:+lCodWFCwb/HwJh8HOu

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2792 set thread context of 2888	2792	regsvr32.exe	30

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2888	2792	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\HexaPort.dll
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\System32\msiexec.exe
  \??\C:\Windows\System32\msiexec.exe
  2⤵
  PID:2888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2792-0-0x0000000002720000-0x00000000028C9000-memory.dmp

Filesize
1.7MB

Download
memory/2888-7-0x0000000000030000-0x00000000000C0000-memory.dmp

Filesize
576KB

Download
memory/2888-8-0x0000000000030000-0x00000000000C0000-memory.dmp

Filesize
576KB

Download