2196592d9206a2cb569f62c5b33e8054949bdcea90fd01cbd7174d7954f3a82a | Triage

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:44

Sharing

Report Analysis Logs

General

Target

libisccc.dll
Size

72KB
MD5

7cb3338dd3b47fc393ee9510a771126e
SHA1

6e668c2446b45bfedbc38710ecbe69c883e55b6c
SHA256

dae470a9efd1347f28e59b0ce39375b810560bbece0148e987cc6f7a5389ef2f
SHA512

7324f50838acbf92cc8cdee884e43b0f99dc0e218a9ea6b3da7ec4ead0e1bbefaa293ad8555faf6ca621498fed7e912d8324c7e495d17c1856ab543fbd5ee904
SSDEEP

1536:tAI9perMhcba5PeSN3yCJPtcJHcq+PqPoqdS5qPq5FfZrwKnrUsrjK:JWrMiba5PeSFyCJPtcFc/Paor5QwRrwe

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2820	2412	rundll32.exe	28
PID 2412 wrote to memory of 2820	2412	rundll32.exe	28
PID 2412 wrote to memory of 2820	2412	rundll32.exe	28
PID 2412 wrote to memory of 2820	2412	rundll32.exe	28
PID 2412 wrote to memory of 2820	2412	rundll32.exe	28
PID 2412 wrote to memory of 2820	2412	rundll32.exe	28
PID 2412 wrote to memory of 2820	2412	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccc.dll,#1
  2⤵
  PID:2820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2820-0-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download
memory/2820-1-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download