4acf1581ad3341dac2f665a455ad97b3dfebe4cb71e4d7332dd11fdc908c1f8e | Triage

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

libisccc.dll
Size

72KB
MD5

f5aa3f8618112a2683e6e731f6388746
SHA1

b0bd82412f7b71058d5936dac2705098e9674c93
SHA256

cc7deb89092ddf766b47677695751186e7135c571642dd9bc1864756103b45d8
SHA512

2171f17c4102f5d573074a445c5c8966fb42246b99566242a63d9ed161f5a11381a0e5959e7b36037ae3e5f5e02b90d30b5af4360803779407fe5c0ca13cfc12
SSDEEP

1536:iFALwyLHocHjf2TH9IDZl1gypZfeDfb4pNFnHnjUPn3mU+fMFj:BJToYjf2TH9CZl1gypZfefb47FnHnjUJ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2176	2884	rundll32.exe	27
PID 2884 wrote to memory of 2176	2884	rundll32.exe	27
PID 2884 wrote to memory of 2176	2884	rundll32.exe	27
PID 2884 wrote to memory of 2176	2884	rundll32.exe	27
PID 2884 wrote to memory of 2176	2884	rundll32.exe	27
PID 2884 wrote to memory of 2176	2884	rundll32.exe	27
PID 2884 wrote to memory of 2176	2884	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccc.dll,#1
  2⤵
  PID:2176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2176-0-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download
memory/2176-1-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download