3a988e442285b36fb8b471da5ff81bd5d1ef2971fc2f991018bf1d51c98e9a20 | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:03

Sharing

Report Analysis Logs

General

Target

libisc.dll
Size

396KB
MD5

5458f911ef465b5961596344d55263c1
SHA1

a8b07e052e29e2721cd8d2a85ae3bca452c3de2e
SHA256

9f3ef692b83d5ce4896314378f58a20c5daf00279371185a79d08faa0d724934
SHA512

d9a65f0f1002021597c178eef0d918e4cc1127dc99218edef3f03d63088874383f23286fbcfb659d646565f217ba2ca5285ef036311eeca28a5d81d957b9de53
SSDEEP

6144:gG+v8ry0sckp45VqAwUE7rTb+6W43Z7RoOWq0aEvNguFHFHfyi:DXryXMgAwUE7rTb+6W43Z7+qBEFjHp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1104	2188	rundll32.exe	27
PID 2188 wrote to memory of 1104	2188	rundll32.exe	27
PID 2188 wrote to memory of 1104	2188	rundll32.exe	27
PID 2188 wrote to memory of 1104	2188	rundll32.exe	27
PID 2188 wrote to memory of 1104	2188	rundll32.exe	27
PID 2188 wrote to memory of 1104	2188	rundll32.exe	27
PID 2188 wrote to memory of 1104	2188	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisc.dll,#1
  2⤵
  PID:1104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-0-0x0000000010000000-0x0000000010089000-memory.dmp

Filesize
548KB

Download