feb77740eb6d9683514987b51d8d4148f3521d2971525aff05516bc181db917f | Triage

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2023 02:53

Sharing

Report Analysis Logs

General

Target

ScaleGfx.dll
Size

26KB
MD5

24f18a26234995142f17d7369af16992
SHA1

8d208fc57ecb29b03fa4ae8eab7a60b77a2b9f80
SHA256

db4ed83c6dcc0fe713b2b69914cef9058400076b11513508b3bbbee848a2ae66
SHA512

64fe5c83dd3ee48746d305cf0bcae6a355cd94b806332a4d6797dfa9ef90a65d28ce97d89942f4088f9f4816fded094628d5e316b627cecd785d524c373520d0
SSDEEP

768:whbanF0ZURpfxUJ1PKsLCAoFI0ISYjFp6bfsEPA67xM:fnwUR9xUJN5+FQBrmsEPA67xM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1428	1692	rundll32.exe	86
PID 1692 wrote to memory of 1428	1692	rundll32.exe	86
PID 1692 wrote to memory of 1428	1692	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ScaleGfx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ScaleGfx.dll,#1
  2⤵
  PID:1428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads