3a988e442285b36fb8b471da5ff81bd5d1ef2971fc2f991018bf1d51c98e9a20

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:03

Target

libisccfg.dll
Size

108KB
MD5

122f406a8f415ea977b6291ce1f6c6d0
SHA1

ffa154a544639579c61ab19885320cf8042fbbf2
SHA256

7c01b51c944b6142aff086bf21b7ee152836605d26dd977111142a9b43b6ffd5
SHA512

4331b10b3c5d0688d6d3ad818c482727284bb8317c5ad59edf031b6c62b1efa2b766717ac039d6152b522707a48360771dcb88c305103e49f9b2185bd1123e8c
SSDEEP

768:VC1w2/mpdeUXzrXbeC41YDVw5kFtuCumEcDKBz+gpK5Jc7GU15x6rLjPYsgx:Vqnepow41MyMtrbgpK54GU1eLjAsgx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 3012	2940	rundll32.exe	28
PID 2940 wrote to memory of 3012	2940	rundll32.exe	28
PID 2940 wrote to memory of 3012	2940	rundll32.exe	28
PID 2940 wrote to memory of 3012	2940	rundll32.exe	28
PID 2940 wrote to memory of 3012	2940	rundll32.exe	28
PID 2940 wrote to memory of 3012	2940	rundll32.exe	28
PID 2940 wrote to memory of 3012	2940	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccfg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccfg.dll,#1
  2⤵
  PID:3012

memory/3012-0-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download
memory/3012-1-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download
memory/3012-2-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download