9abc5df0d92751d103ebde78da3fd31630878b987cebd730d655fce5507d129d | Triage

Analysis

max time kernel
121s
max time network
135s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 13:52

Sharing

Report Analysis Logs

General

Target

libisccc.dll
Size

72KB
MD5

053929fcaf36cb1d60ddd05012987d2e
SHA1

a8185790b385f1426bc47202fb616fa84b12fa48
SHA256

27e47e67b0da97dae6e511f2e40f2fb35963b9c0d2d6b42aa01764bbd4890c74
SHA512

6208aefca647034d2085cfb3df1223a9bc86171166a55b85cedd2f15a409a37dfca05a251f1d05c22c8310e9afd76a4a641d96cb6bbd979872cc515c3fe524d0
SSDEEP

1536:LxRlWNssi0t2neLc3mDfE6enSEzhUb3bEQhA2gGD3UGUi/0Fj:1W+si0t2neLc3gfE6enSEzyb3bThA2g9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2880	1692	rundll32.exe	27
PID 1692 wrote to memory of 2880	1692	rundll32.exe	27
PID 1692 wrote to memory of 2880	1692	rundll32.exe	27
PID 1692 wrote to memory of 2880	1692	rundll32.exe	27
PID 1692 wrote to memory of 2880	1692	rundll32.exe	27
PID 1692 wrote to memory of 2880	1692	rundll32.exe	27
PID 1692 wrote to memory of 2880	1692	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccc.dll,#1
  2⤵
  PID:2880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2880-0-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download