e2f383123254f5b4a91cc8ea7fbe6d2a44c779368777207736a02a125d5c477b | Triage

Analysis

max time kernel
141s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 13:31

Sharing

Report Analysis Logs

General

Target

wsc.dll
Size

76KB
MD5

dc52696888f68d5b0e3d5e810c0d2a3c
SHA1

f72a97bf9ab09b3639c3c58c9c34d3675a507b87
SHA256

a1640a83373a8ce9e80734418ee0b10d48d3d0d823883a519849b50710c9f46a
SHA512

22cbe643038002e2d9dec7ffed7ba445ee1288571b445a8156c8bc533815bd330098893792b43c5592a881675a089f0b0229a230672569c62fa1032bec5ffcb2
SSDEEP

768:QVoWTrjr3eBjVgiHYSNjhCgk5NwF6fA6QzJhmlx3eBtBAmtXEty:QXTaySjCJm3mHuNtXEt

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 1052	3204	rundll32.exe	80
PID 3204 wrote to memory of 1052	3204	rundll32.exe	80
PID 3204 wrote to memory of 1052	3204	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wsc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\wsc.dll,#1
  2⤵
  PID:1052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads