3e3ea9573e7f8217d0f7e46de56c06e7db2541fe59b662d29738a97f2bda7b8d | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 22:44

Sharing

Report Analysis Logs

General

Target

MDScan.dll
Size

45KB
MD5

90c60b482037567b0c6a1dc0816718b2
SHA1

7bc899f4e5678a42f4cceb48ae0592a750b4aa9a
SHA256

b1eb40411c1e8d79512a4e0313928a1171ae38f89a41a118d3c4d990dca36e20
SHA512

ff69c7a715458194943e9f032f3c3a51152f521ec928bd3b8b4857395bbbb92041fc4e2f8358299322369ff2a2b1cdda0da723994c1760f831ccc89a3aa0a726
SSDEEP

768:Ru/Y0WshXGu3KpLLgVjDoAyGqyj+qEnKJY7Gsu7SnVA8K2ZoYH:0AK0LL6jDoAd5KjnKC7GsLVA7coY

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 1788	2988	rundll32.exe	30
PID 2988 wrote to memory of 1788	2988	rundll32.exe	30
PID 2988 wrote to memory of 1788	2988	rundll32.exe	30
PID 2988 wrote to memory of 1788	2988	rundll32.exe	30
PID 2988 wrote to memory of 1788	2988	rundll32.exe	30
PID 2988 wrote to memory of 1788	2988	rundll32.exe	30
PID 2988 wrote to memory of 1788	2988	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MDScan.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MDScan.dll,#1
  2⤵
  PID:1788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads