2196592d9206a2cb569f62c5b33e8054949bdcea90fd01cbd7174d7954f3a82a | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:44

Sharing

Report Analysis Logs

General

Target

libisccfg.dll
Size

116KB
MD5

f75350e85d0ec97220e662d29d216edf
SHA1

035a24f4d5d65d5011daf4c7406ebcd8248c98d2
SHA256

3ab5668fb17d2a4fdc1f11ce24c41c0fa97295468a77c04d52723699707abe20
SHA512

9293a7b4146f60626ac05cbe52fc6d7805f69b7d80ba41f102d948c924748831f967655eba21ba85664482c6a42e546e147e407861dc9e4b7406a34a6464a68b
SSDEEP

1536:5SQYZt7/i1pUfesCgLA60t/w6nkVYKXsarUYZKTlT9y:0QYZt7q1pUFLCw6nkVY8rUYZGT9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 2004	1076	rundll32.exe	28
PID 1076 wrote to memory of 2004	1076	rundll32.exe	28
PID 1076 wrote to memory of 2004	1076	rundll32.exe	28
PID 1076 wrote to memory of 2004	1076	rundll32.exe	28
PID 1076 wrote to memory of 2004	1076	rundll32.exe	28
PID 1076 wrote to memory of 2004	1076	rundll32.exe	28
PID 1076 wrote to memory of 2004	1076	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccfg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccfg.dll,#1
  2⤵
  PID:2004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2004-0-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/2004-1-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/2004-2-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/2004-3-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download