00f1020463841d00ba0eb7e52a655106d7ce340358324c39b7ff0a64a6489d9b | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 01:29

Sharing

Report Analysis Logs

General

Target

DSC080.dll
Size

115KB
MD5

e0f74c9fde49b76fab5b2b573a229478
SHA1

90416b05807bd27bda40cc57992743706ab69cba
SHA256

46bda60a69c0042fa6ee8be8f20fa0148fd99b3b93807078e04ab636f2b8315e
SHA512

f23568ce2306492f264b6ee3ccf5f3ec4b83ca0c8c24c747da948982334a2a22efa7663c52132102369809b09f2185794d35e23d518bf75e82b7b03386a99447
SSDEEP

3072:IuRguCGyJnyLR2NHqQYDLiRsM+seMdsdVwuZwvhmKw:5g/Xo1AqQzeMdsdVwu2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 1840	2276	rundll32.exe	28
PID 2276 wrote to memory of 1840	2276	rundll32.exe	28
PID 2276 wrote to memory of 1840	2276	rundll32.exe	28
PID 2276 wrote to memory of 1840	2276	rundll32.exe	28
PID 2276 wrote to memory of 1840	2276	rundll32.exe	28
PID 2276 wrote to memory of 1840	2276	rundll32.exe	28
PID 2276 wrote to memory of 1840	2276	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DSC080.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DSC080.dll,#1
  2⤵
  PID:1840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1840-0-0x00000000001D0000-0x00000000001F2000-memory.dmp

Filesize
136KB

Download