3a988e442285b36fb8b471da5ff81bd5d1ef2971fc2f991018bf1d51c98e9a20

Analysis

max time kernel
154s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

libisccfg.dll
Size

108KB
MD5

122f406a8f415ea977b6291ce1f6c6d0
SHA1

ffa154a544639579c61ab19885320cf8042fbbf2
SHA256

7c01b51c944b6142aff086bf21b7ee152836605d26dd977111142a9b43b6ffd5
SHA512

4331b10b3c5d0688d6d3ad818c482727284bb8317c5ad59edf031b6c62b1efa2b766717ac039d6152b522707a48360771dcb88c305103e49f9b2185bd1123e8c
SSDEEP

768:VC1w2/mpdeUXzrXbeC41YDVw5kFtuCumEcDKBz+gpK5Jc7GU15x6rLjPYsgx:Vqnepow41MyMtrbgpK54GU1eLjAsgx

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1612	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 4612	1156	rundll32.exe	87
PID 1156 wrote to memory of 4612	1156	rundll32.exe	87
PID 1156 wrote to memory of 4612	1156	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccfg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccfg.dll,#1
  2⤵
  PID:4612

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
b3e0268328b99777ddd9f7334e9dea3c

SHA1
1f894331c903b3e2baf4b5dfdc0b37f47d5e6b0f

SHA256
98456c8196bfdc9bc4efdea7686ddca81cf8e6e30b540c038f04c30799fb691d

SHA512
e4080a631b15c645bfba77f106629db6d0acc1243917b3cd921c135902987ae47db3c213692b643007f8cae98f2d5da184de74a57703461a424f62c4f0ffced4

Download Submit
memory/1612-42-0x00000271FA5F0000-0x00000271FA5F1000-memory.dmp

Filesize
4KB

Download
memory/1612-39-0x00000271FA5F0000-0x00000271FA5F1000-memory.dmp

Filesize
4KB

Download
memory/1612-33-0x00000271FA5D0000-0x00000271FA5D1000-memory.dmp

Filesize
4KB

Download
memory/1612-34-0x00000271FA5F0000-0x00000271FA5F1000-memory.dmp

Filesize
4KB

Download
memory/1612-35-0x00000271FA5F0000-0x00000271FA5F1000-memory.dmp

Filesize
4KB

Download
memory/1612-36-0x00000271FA5F0000-0x00000271FA5F1000-memory.dmp

Filesize
4KB

Download
memory/1612-37-0x00000271FA5F0000-0x00000271FA5F1000-memory.dmp

Filesize
4KB

Download
memory/1612-43-0x00000271FA5F0000-0x00000271FA5F1000-memory.dmp

Filesize
4KB

Download
memory/1612-69-0x00000271FA470000-0x00000271FA471000-memory.dmp

Filesize
4KB

Download
memory/1612-40-0x00000271FA5F0000-0x00000271FA5F1000-memory.dmp

Filesize
4KB

Download
memory/1612-17-0x00000271F2040000-0x00000271F2050000-memory.dmp

Filesize
64KB

Download
memory/1612-41-0x00000271FA5F0000-0x00000271FA5F1000-memory.dmp

Filesize
4KB

Download
memory/1612-38-0x00000271FA5F0000-0x00000271FA5F1000-memory.dmp

Filesize
4KB

Download
memory/1612-44-0x00000271FA220000-0x00000271FA221000-memory.dmp

Filesize
4KB

Download
memory/1612-45-0x00000271FA210000-0x00000271FA211000-memory.dmp

Filesize
4KB

Download
memory/1612-47-0x00000271FA220000-0x00000271FA221000-memory.dmp

Filesize
4KB

Download
memory/1612-50-0x00000271FA210000-0x00000271FA211000-memory.dmp

Filesize
4KB

Download
memory/1612-53-0x00000271FA150000-0x00000271FA151000-memory.dmp

Filesize
4KB

Download
memory/1612-1-0x00000271F1F40000-0x00000271F1F50000-memory.dmp

Filesize
64KB

Download
memory/1612-65-0x00000271FA350000-0x00000271FA351000-memory.dmp

Filesize
4KB

Download
memory/1612-67-0x00000271FA360000-0x00000271FA361000-memory.dmp

Filesize
4KB

Download
memory/1612-68-0x00000271FA360000-0x00000271FA361000-memory.dmp

Filesize
4KB

Download
memory/4612-0-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads