38ca21a90eb0ee626882937da2a914b308d05d70192c2d3bc311aafc9abd4e48 | Triage

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 09:08

Sharing

Report Analysis Logs

General

Target

DSC030.dll
Size

115KB
MD5

79221db426648e48972fc37a83ecdaf2
SHA1

aa4727902d1f49071d5033f78111ee8f38a40304
SHA256

c97817100d5f1c607d48d0a6c9564b5ce3ba29539c7cfe08b40b1362194edb08
SHA512

e7c8fedae5ffa41f0959b89ae3d8c4b1f611004349dc6c13a35a405fad0c39f101451d2b5cfdfd98020ff91aaa84e3fffe5a964d6f55581f2d0d1ed8364ab36c
SSDEEP

3072:LuRguCGyJnyLR2NHqQYDLiRsM+seMdsdVwuZ4J+mNw:ug/Xo1AqQzeMdsdVwua

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 4936	4564	rundll32.exe	81
PID 4564 wrote to memory of 4936	4564	rundll32.exe	81
PID 4564 wrote to memory of 4936	4564	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DSC030.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DSC030.dll,#1
  2⤵
  PID:4936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4936-133-0x0000000000800000-0x0000000000822000-memory.dmp

Filesize
136KB

Download