3c5d9ac0741850b5e6bf3af8c807b7ccfdb1bfc702cd75d8897a27b1387031c7 | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 03:48

Sharing

Report Analysis Logs

General

Target

AvastSvcyHA/wsc.dll
Size

52KB
MD5

fd866f6e1b997c31bdb6ba24361663e5
SHA1

fdf4296522e9ad7ed6d2b7a8aa53debb15566c19
SHA256

28875b1d6206e41ddcdbae56c6001915735c08f11f6a77db5a7107a4236afb34
SHA512

05e8aeb4d0f318db1943797f22388cbc43432b8206fc2b2a38505f2cacbcf25b7058015ea5e462d1778f20b3b31e256a1747f7416e26a939e5eb60b8664ad49c
SSDEEP

768:nqAyRlzgT291lvLotX8UoImwKtZ+eiVoKWUkfbZoJBl:nqAyR1gTWPc3mwje3o2oJ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2000 wrote to memory of 1948	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1948	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1948	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1948	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1948	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1948	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 1948	2000	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AvastSvcyHA\wsc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AvastSvcyHA\wsc.dll,#1
2⤵
PID:1948

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1948-54-0x0000000000000000-mapping.dmp

Download
memory/1948-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download