feb77740eb6d9683514987b51d8d4148f3521d2971525aff05516bc181db917f | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
03-11-2023 02:53

Sharing

Report Analysis Logs

General

Target

ScaleGfx.dll
Size

26KB
MD5

24f18a26234995142f17d7369af16992
SHA1

8d208fc57ecb29b03fa4ae8eab7a60b77a2b9f80
SHA256

db4ed83c6dcc0fe713b2b69914cef9058400076b11513508b3bbbee848a2ae66
SHA512

64fe5c83dd3ee48746d305cf0bcae6a355cd94b806332a4d6797dfa9ef90a65d28ce97d89942f4088f9f4816fded094628d5e316b627cecd785d524c373520d0
SSDEEP

768:whbanF0ZURpfxUJ1PKsLCAoFI0ISYjFp6bfsEPA67xM:fnwUR9xUJN5+FQBrmsEPA67xM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2360	2284	rundll32.exe	27
PID 2284 wrote to memory of 2360	2284	rundll32.exe	27
PID 2284 wrote to memory of 2360	2284	rundll32.exe	27
PID 2284 wrote to memory of 2360	2284	rundll32.exe	27
PID 2284 wrote to memory of 2360	2284	rundll32.exe	27
PID 2284 wrote to memory of 2360	2284	rundll32.exe	27
PID 2284 wrote to memory of 2360	2284	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ScaleGfx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ScaleGfx.dll,#1
  2⤵
  PID:2360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads