4036df60e76f069f27da954142060ae81e98d61691a66e6fef567320a9ef4c03 | Triage

Analysis

max time kernel
135s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 14:40

Sharing

Report Analysis Logs

General

Target

libisc.dll
Size

484KB
MD5

e8baa9d7a653f0794b635f269f823d49
SHA1

63e0405d8a5aea53b570f873d4ed4d932a8a0498
SHA256

6763be751561fb672d250dd621252d9da35cc5009dbe3cc03cebea44b1afdf57
SHA512

fa137d90a77890c61b48784215dd3671ee8420086162a58505ffb2a73cb5a45f5db82089f79ea93888691cf73be98f7586ccf6b9bc3d95568f91e0d7c1a7e7ed
SSDEEP

12288:xcleGtuiH1xAwUE7rTb+6W43Z73oLtCfwe9MssK6e8:OleniVJoLtComvsK6e8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 4928	1352	rundll32.exe	83
PID 1352 wrote to memory of 4928	1352	rundll32.exe	83
PID 1352 wrote to memory of 4928	1352	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisc.dll,#1
  2⤵
  PID:4928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4928-0-0x0000000010000000-0x00000000100A7000-memory.dmp

Filesize
668KB

Download