9227fd96951a6422a0bd8dd93579e191c880b2f05eaa52606f58bd1615509480 | Triage

Analysis

max time kernel
174s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:25

Sharing

Report Analysis Logs

General

Target

libisc.dll
Size

472KB
MD5

66eef3c2db25b1691738f8fbc0da5a96
SHA1

6f64aa41eb4cbeff1e7780118f43ee82b95d8748
SHA256

5bd48151326d0015cf5ad86d4345fbde948c8daf933039bba6eb3916c1c1289a
SHA512

de5a1c81ff361ed89802324aa6ab9bf0240c8091d64eb489e4bc2f99d5c6852052416a49b27b0b9b7002dfa6af658d0449b4c0ca190bb079d45b9d72582e8307
SSDEEP

12288:DuoqV9RAwUE7rTb+6W43Z7edfxGachZrs:9qfodfxFkps

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 4156	552	rundll32.exe	88
PID 552 wrote to memory of 4156	552	rundll32.exe	88
PID 552 wrote to memory of 4156	552	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisc.dll,#1
  2⤵
  PID:4156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4156-0-0x0000000010000000-0x00000000100A3000-memory.dmp

Filesize
652KB

Download