2196592d9206a2cb569f62c5b33e8054949bdcea90fd01cbd7174d7954f3a82a | Triage

Analysis

max time kernel
107s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:44

Sharing

Report Analysis Logs

General

Target

libisc.dll
Size

480KB
MD5

21cb181ab711adfcddf105f7fee70d6b
SHA1

5f816637062217bbe03197449743e4d325b880d3
SHA256

66693f0bb5b69f5ef5cbf89c2c61e8a39639be2ed2c3672e674dd8940961abac
SHA512

57eba0e8ad060b41f6d6e9bf4de9f53e436e4bc088175149b6aa6399dbe8e30659a2a81d6bef52fe6bd8bb7fcae5aecc127d8149244494f80642915ebf66927a
SSDEEP

12288:oWm1lx8nhlOSAwUE7rTb+6W43Z7Sg8y/NWxLtI5HkQ:olilOxgL/sVu5x

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 3116	4016	rundll32.exe	59
PID 4016 wrote to memory of 3116	4016	rundll32.exe	59
PID 4016 wrote to memory of 3116	4016	rundll32.exe	59

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisc.dll,#1
  2⤵
  PID:3116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3116-0-0x0000000010000000-0x00000000100A6000-memory.dmp

Filesize
664KB

Download