aa4ff6b03e2b22f226a68619c989741b347bd5d368572cf2b44de9f26391dab4 | Triage

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:29

Sharing

Report Analysis Logs

General

Target

libisc.dll
Size

480KB
MD5

9b16d6300393288153b49cfa74a1e303
SHA1

e3fdffc25271f3592973cb42946c20a007182a42
SHA256

3204a776e0cce9a6e8fdf8e540964d67ae31b473d3c8b3d66ec6bcccb629405c
SHA512

3dd1d89bf31c571a375b317fab78203a0efd6399318f54b58b2c3a451f2e0e96a8e860281f65c525b8e8d8edabde4d32b874a7da4ad174536086679c4b10a28b
SSDEEP

12288:HdDSbzpJAwUE7rTb+6W43Z7EkOcAhjkz2/Tj:CSkOnhISbj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 4896	4732	rundll32.exe	89
PID 4732 wrote to memory of 4896	4732	rundll32.exe	89
PID 4732 wrote to memory of 4896	4732	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisc.dll,#1
  2⤵
  PID:4896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4896-0-0x0000000010000000-0x00000000100A6000-memory.dmp

Filesize
664KB

Download