38ca21a90eb0ee626882937da2a914b308d05d70192c2d3bc311aafc9abd4e48 | Triage

Analysis

max time kernel
43s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 09:08

Sharing

Report Analysis Logs

General

Target

DSC030.dll
Size

115KB
MD5

79221db426648e48972fc37a83ecdaf2
SHA1

aa4727902d1f49071d5033f78111ee8f38a40304
SHA256

c97817100d5f1c607d48d0a6c9564b5ce3ba29539c7cfe08b40b1362194edb08
SHA512

e7c8fedae5ffa41f0959b89ae3d8c4b1f611004349dc6c13a35a405fad0c39f101451d2b5cfdfd98020ff91aaa84e3fffe5a964d6f55581f2d0d1ed8364ab36c
SSDEEP

3072:LuRguCGyJnyLR2NHqQYDLiRsM+seMdsdVwuZ4J+mNw:ug/Xo1AqQzeMdsdVwua

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26
PID 1352 wrote to memory of 1528	1352	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DSC030.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DSC030.dll,#1
  2⤵
  PID:1528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1528-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download
memory/1528-56-0x00000000001B0000-0x00000000001D2000-memory.dmp

Filesize
136KB

Download