3a988e442285b36fb8b471da5ff81bd5d1ef2971fc2f991018bf1d51c98e9a20 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:03

Sharing

Report Analysis Logs

General

Target

libisccc.dll
Size

72KB
MD5

98f825def01ab479aa61f34e4e883f15
SHA1

47a85ae61ce730b366a95c00bb29f1955219680e
SHA256

8dcd1e7eaae7f3d2d47702e8a353ba138cf1d9cc2a254a5f9b8558f35937be19
SHA512

f67d3bc7f7a1da3a8eae47f19eee86ce455c5b757093e3a8f8e265726244e657cba6bef714ef898634381c5eadf6cd2ab3079f14cb07f5f1235e25eaf873874f
SSDEEP

1536:mBLEwmv/lkijf2TH9IDZlM2ypiflDfD4PONF3/ujUX+RmUmRFj:R1HlNjf2TH9CZlM2ypifFfD44F3/ujUp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1800	2252	rundll32.exe	28
PID 2252 wrote to memory of 1800	2252	rundll32.exe	28
PID 2252 wrote to memory of 1800	2252	rundll32.exe	28
PID 2252 wrote to memory of 1800	2252	rundll32.exe	28
PID 2252 wrote to memory of 1800	2252	rundll32.exe	28
PID 2252 wrote to memory of 1800	2252	rundll32.exe	28
PID 2252 wrote to memory of 1800	2252	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccc.dll,#1
  2⤵
  PID:1800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1800-0-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download
memory/1800-1-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download
memory/1800-2-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download