aa4ff6b03e2b22f226a68619c989741b347bd5d368572cf2b44de9f26391dab4 | Triage

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:29

Sharing

Report Analysis Logs

General

Target

libisc.dll
Size

480KB
MD5

9b16d6300393288153b49cfa74a1e303
SHA1

e3fdffc25271f3592973cb42946c20a007182a42
SHA256

3204a776e0cce9a6e8fdf8e540964d67ae31b473d3c8b3d66ec6bcccb629405c
SHA512

3dd1d89bf31c571a375b317fab78203a0efd6399318f54b58b2c3a451f2e0e96a8e860281f65c525b8e8d8edabde4d32b874a7da4ad174536086679c4b10a28b
SSDEEP

12288:HdDSbzpJAwUE7rTb+6W43Z7EkOcAhjkz2/Tj:CSkOnhISbj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 1712	2968	rundll32.exe	28
PID 2968 wrote to memory of 1712	2968	rundll32.exe	28
PID 2968 wrote to memory of 1712	2968	rundll32.exe	28
PID 2968 wrote to memory of 1712	2968	rundll32.exe	28
PID 2968 wrote to memory of 1712	2968	rundll32.exe	28
PID 2968 wrote to memory of 1712	2968	rundll32.exe	28
PID 2968 wrote to memory of 1712	2968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisc.dll,#1
  2⤵
  PID:1712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1712-0-0x0000000010000000-0x00000000100A6000-memory.dmp

Filesize
664KB

Download
memory/1712-1-0x0000000010000000-0x00000000100A6000-memory.dmp

Filesize
664KB

Download
memory/1712-2-0x0000000010000000-0x00000000100A6000-memory.dmp

Filesize
664KB

Download