fd84fbbb02015979484e56ee1f8de94df66b7c031c8df094c25ee8d4189e2f62 | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
15-11-2023 04:28

Sharing

Report Analysis Logs

General

Target

WCUtil.dll
Size

180KB
MD5

beba3433dad54f893f6e8c5c7bfb024d
SHA1

d3b650571f65b4c021a551f05b3f6e2e645fc192
SHA256

fd84fbbb02015979484e56ee1f8de94df66b7c031c8df094c25ee8d4189e2f62
SHA512

e6fe7e57709dcbd2ba6168758f689ace795276be1fcff884bd476db3aca82e7de4f7d6f6255c608053690015ea96ec97c88f839524f419391788ee6b3176102f
SSDEEP

3072:I74+blpt+wsxMl1NqAc5iSttkClpelrlLMbVaKoXAxOPYe:I74elpowsxizqyStZlpel5AyAxOPF

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 844	2172	rundll32.exe	28
PID 2172 wrote to memory of 844	2172	rundll32.exe	28
PID 2172 wrote to memory of 844	2172	rundll32.exe	28
PID 2172 wrote to memory of 844	2172	rundll32.exe	28
PID 2172 wrote to memory of 844	2172	rundll32.exe	28
PID 2172 wrote to memory of 844	2172	rundll32.exe	28
PID 2172 wrote to memory of 844	2172	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WCUtil.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WCUtil.dll,#1
  2⤵
  PID:844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads