0e3e47697539f1773fb53114ab53229c0304d86ed35aec05e5f5bfdf3bd35f9a | Triage

Analysis

max time kernel
166s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
04/06/2022, 19:33 UTC

Sharing

Report Analysis Logs

General

Target

wsc.dll
Size

76KB
MD5

fc83d5c67de996607b0a59d70e6ff711
SHA1

c44c923ab0331d3f7cee588eb73464ce93cf4ce4
SHA256

5a795c4b2a1a9c76791a516822ae0c9ec9d02780c41d2f6a6960a4ea15d68e34
SHA512

11cd6230ec8906dd91a2719bccb82f59bcbc027ba94959a7aae5614c4e8f9669d736abdaade1cc0d1183bb7db3a7391fc7be14c6e5685e312e5f48a625c83f81

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 3188	3404	rundll32.exe	76
PID 3404 wrote to memory of 3188	3404	rundll32.exe	76
PID 3404 wrote to memory of 3188	3404	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wsc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\wsc.dll,#1
  2⤵
  PID:3188

Network

No results found

67.26.211.254:80

260 B
5
93.184.220.29:80

260 B
5
209.197.3.8:80

322 B
7
93.184.220.29:80

260 B
5
67.24.169.254:80

260 B
5
67.26.211.254:80

260 B
5
13.69.239.73:443

322 B
7
67.26.211.254:80

322 B
7
67.26.211.254:80

322 B
7
67.26.211.254:80

46 B
40 B
1
1
67.26.211.254:80

46 B
40 B
1
1
204.79.197.203:80

322 B
7
67.26.211.254:80

260 B
5
67.24.169.254:80

260 B
5
67.26.207.254:80

156 B
3

No results found

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads