aa4ff6b03e2b22f226a68619c989741b347bd5d368572cf2b44de9f26391dab4 | Triage

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:29

Sharing

Report Analysis Logs

General

Target

libisccc.dll
Size

72KB
MD5

deef80b126d754798dc6797e57afadda
SHA1

96a9bc1e3f8e3238dec7c54a56400a0b1e88799d
SHA256

59746b977b18857f937736e00012b8f63a4fc6d7ad7eb8a15b047966ab503acb
SHA512

0c9867fd0ef3f324334794c618ae798f42222df9177314a131baa0864d387d65374ba6b1ce9cecf137a4b880efaf6cc98afb0c0767069a63ff6679ae877d9de6
SSDEEP

1536:QJbGoVZuAifBvoPn540Dk1hs90+JVHtK3OZTlcueBX3vPmUBL+Fj:E9DifBvoPn54Gk1hs90+JRtK3YTlneBy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 3196	4868	rundll32.exe	88
PID 4868 wrote to memory of 3196	4868	rundll32.exe	88
PID 4868 wrote to memory of 3196	4868	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccc.dll,#1
  2⤵
  PID:3196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3196-0-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download