3e3ea9573e7f8217d0f7e46de56c06e7db2541fe59b662d29738a97f2bda7b8d | Triage

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 22:44

Sharing

Report Analysis Logs

General

Target

MDScan.dll
Size

45KB
MD5

90c60b482037567b0c6a1dc0816718b2
SHA1

7bc899f4e5678a42f4cceb48ae0592a750b4aa9a
SHA256

b1eb40411c1e8d79512a4e0313928a1171ae38f89a41a118d3c4d990dca36e20
SHA512

ff69c7a715458194943e9f032f3c3a51152f521ec928bd3b8b4857395bbbb92041fc4e2f8358299322369ff2a2b1cdda0da723994c1760f831ccc89a3aa0a726
SSDEEP

768:Ru/Y0WshXGu3KpLLgVjDoAyGqyj+qEnKJY7Gsu7SnVA8K2ZoYH:0AK0LL6jDoAd5KjnKC7GsLVA7coY

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 3300	2916	rundll32.exe	84
PID 2916 wrote to memory of 3300	2916	rundll32.exe	84
PID 2916 wrote to memory of 3300	2916	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MDScan.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MDScan.dll,#1
  2⤵
  PID:3300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3300-0-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download