0ad89051c06b4a5cd4bb2e6c4503adc957d0962b0388e811f07bcaebb4146bac

Analysis

max time kernel
144s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:08

Target

libisccfg.dll
Size

108KB
MD5

3e14ed0826c008e49fd27524609dfa85
SHA1

5ba2839e9fa73432ac35c252ccce07e93422f3c7
SHA256

e092f56716a79c1f84c5472e2a40c00961ec6fc249a9bcc0e7ea3d10da63c41d
SHA512

5f66529611f1fbb0f52f4cb6a9019946cc56956afe37583062883971fad7f1192b0ea308cac988c945dbeecd60dd693a7c6b81721175b5c5310d55213aabc162
SSDEEP

768:9S5j3OxVV/nCHzr/Tudoyli7dwfzF1Kid+CjxjSpzmpm5Jd5mUDmUIWTqjPusvx:9Ej+xXtoyQwR1nPpm59mUDjnTqjWsvx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 3744	3116	rundll32.exe	86
PID 3116 wrote to memory of 3744	3116	rundll32.exe	86
PID 3116 wrote to memory of 3744	3116	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccfg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccfg.dll,#1
  2⤵
  PID:3744

memory/3744-0-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download