902576f7f90174513a45bc82796b82c9264a57c82c0c72b7c9bf11e7da6bba96 | Triage

Analysis

max time kernel
447s
max time network
454s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
01-04-2024 09:35

Sharing

Report Analysis Logs

General

Target

Plugin/sc2.dll
Size

46KB
MD5

2d65bc3bff4a5d31b59f5bdf6e6311d7
SHA1

43962fbeb93fc267fb1c7036a12b8c5d6f40c28a
SHA256

010b1ec566be774a2d12146f9826aa31fd7eb6ffe7b45ce5e572b2d8c7f815c3
SHA512

b210d447cc9b4b89402a2a1d3d5e9cfe13ae897c47094be4110ed3aac109152c8a45ec138f73b703e7d3799934234cba4ca3f2439b3dd193a4cec671b9edaa6a
SSDEEP

768:mtAX1G0UYRxIDbYDGN5/eoK79QlRfe2AfgFTMBku2T:mtAFZUYA/uW2x9CJe2BFQB

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3952 wrote to memory of 3160	3952	rundll32.exe	rundll32.exe
PID 3952 wrote to memory of 3160	3952	rundll32.exe	rundll32.exe
PID 3952 wrote to memory of 3160	3952	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugin\sc2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3952

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugin\sc2.dll,#1
2⤵
PID:3160

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...