ec4a958ab73fa233b4bb5cbaf68ea3486384997d53740bfa9c3307ce150a59dd | Triage

Analysis

max time kernel
145s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
28-04-2024 10:49

Sharing

Report Analysis Logs

General

Target

sscanner32.dll
Size

352KB
MD5

215f2a2bc94d9e6815a6082630546cc2
SHA1

a7049f4565f13eab2a5f8ea499e10defcbde6007
SHA256

d22ae9a4f7143afe271865e6c81c1f76dd64905ffa9c42d0d7c2d3c187a47faf
SHA512

e5fbde622ba02414bfdead61b93e6080f766a19c91dc1b4803c9d042efcbb468c7f5bd3ec1e363e6e0b9135df66ed55fbf1a5e62321208411541c599f6b29644
SSDEEP

6144:FerwhTQNs5gTAVmz0g/3EgE18UmgOyirvYy3a2KNp9CKzGjGRR:FerwhTQNs5uAV20KfE8TyirwqCP//

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4644 wrote to memory of 4360	4644	rundll32.exe	rundll32.exe
PID 4644 wrote to memory of 4360	4644	rundll32.exe	rundll32.exe
PID 4644 wrote to memory of 4360	4644	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sscanner32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4644

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sscanner32.dll,#1
2⤵
PID:4360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads