4036df60e76f069f27da954142060ae81e98d61691a66e6fef567320a9ef4c03

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:40

Target

libisccc.dll
Size

72KB
MD5

79384beb01869eabf135666f3d94efd5
SHA1

34e97009a4b1db6f54ccf93afb4fbc442bfd2e81
SHA256

208240c0db6a4c996332d0d5b9774b4c09dea8b367fdd1fd661f2486afa9a2f1
SHA512

0693c15724300b2646c8826ea3e61c91c7276827e050436b23c617707cdae45e402ea11a1ef934606948399bcbb21f27d62a96b7502b0bbd099bcbd390373c2c
SSDEEP

1536:9yd8IpoplgwwFHJ1A1DbQ8xMwiJh0hJ2U/GfJALKqYHKYGmUPsPEUlFj3:9a8Blg9FHJ1A1vQ8xMwiJhyJ2U+fJnqc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2016	2924	rundll32.exe	28
PID 2924 wrote to memory of 2016	2924	rundll32.exe	28
PID 2924 wrote to memory of 2016	2924	rundll32.exe	28
PID 2924 wrote to memory of 2016	2924	rundll32.exe	28
PID 2924 wrote to memory of 2016	2924	rundll32.exe	28
PID 2924 wrote to memory of 2016	2924	rundll32.exe	28
PID 2924 wrote to memory of 2016	2924	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccc.dll,#1
  2⤵
  PID:2016

memory/2016-0-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download
memory/2016-1-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download
memory/2016-2-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download