9227fd96951a6422a0bd8dd93579e191c880b2f05eaa52606f58bd1615509480 | Triage

Analysis

max time kernel
129s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

libisccc.dll
Size

72KB
MD5

cbce69aab5c91379bdc7e033d0e8a44b
SHA1

3026a3e71561738408de2727d9fe4c765d50e499
SHA256

6bfc8a5ee9074b1a95e963c78536febf5cb8142d9f83f5a28ddc55774c0b7716
SHA512

a20cf45c6530e365b9bc71b28e44f8506634316058141a43a4fae8e2cc599c4d3a9a5405c86a3ef04b96b666e2ef9d47ad7bbce300235949278675ab42090ef8
SSDEEP

1536:ZtTowKnv9Y5jf2TH9IDZlUipypyf6DfD4dNFH2IrjUsIXmUZhFj:QBv9ajf2TH9CZlUipypyfqfD4XFH2Ir6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 3940	2628	rundll32.exe	87
PID 2628 wrote to memory of 3940	2628	rundll32.exe	87
PID 2628 wrote to memory of 3940	2628	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccc.dll,#1
  2⤵
  PID:3940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3940-0-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download