2196592d9206a2cb569f62c5b33e8054949bdcea90fd01cbd7174d7954f3a82a | Triage

Analysis

max time kernel
149s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 14:44

Sharing

Report Analysis Logs

General

Target

libisccfg.dll
Size

116KB
MD5

f75350e85d0ec97220e662d29d216edf
SHA1

035a24f4d5d65d5011daf4c7406ebcd8248c98d2
SHA256

3ab5668fb17d2a4fdc1f11ce24c41c0fa97295468a77c04d52723699707abe20
SHA512

9293a7b4146f60626ac05cbe52fc6d7805f69b7d80ba41f102d948c924748831f967655eba21ba85664482c6a42e546e147e407861dc9e4b7406a34a6464a68b
SSDEEP

1536:5SQYZt7/i1pUfesCgLA60t/w6nkVYKXsarUYZKTlT9y:0QYZt7q1pUFLCw6nkVY8rUYZGT9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 1876	2848	rundll32.exe	89
PID 2848 wrote to memory of 1876	2848	rundll32.exe	89
PID 2848 wrote to memory of 1876	2848	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccfg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccfg.dll,#1
  2⤵
  PID:1876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1876-0-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download