9abc5df0d92751d103ebde78da3fd31630878b987cebd730d655fce5507d129d | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 13:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

libisc.dll
Size

376KB
MD5

0f9d23749f56e208dd454eeb45a81aea
SHA1

dd58baa55a700757610748dc06e5b65fc20dee4e
SHA256

e22ecd0751dded5935849008b782c3116cbd174243808687932b3588e7151d15
SHA512

2d2f2bc03553cb9e248cefd4fb88aa293104c99521bc727ad435d78af66e304ca62e85fefded3795d68b1e48b8c8724d98e0cb52c08d8fb705e04ccb6f39ee16
SSDEEP

6144:mZAWKzfeLIwnR4RUFFlUktAwUE7rTb+6W43Z74T/VW9lsviaxV6Fq:m+WKELR4RU9AwUE7rTb+6W43Z7uW/sqK

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2312	2264	rundll32.exe	28
PID 2264 wrote to memory of 2312	2264	rundll32.exe	28
PID 2264 wrote to memory of 2312	2264	rundll32.exe	28
PID 2264 wrote to memory of 2312	2264	rundll32.exe	28
PID 2264 wrote to memory of 2312	2264	rundll32.exe	28
PID 2264 wrote to memory of 2312	2264	rundll32.exe	28
PID 2264 wrote to memory of 2312	2264	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisc.dll,#1
  2⤵
  PID:2312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2312-1-0x0000000010000000-0x0000000010082000-memory.dmp

Filesize
520KB

Download
memory/2312-0-0x0000000010000000-0x0000000010082000-memory.dmp

Filesize
520KB

Download
memory/2312-2-0x0000000010000000-0x0000000010082000-memory.dmp

Filesize
520KB

Download