86dabd438734f81d03f76db01608c4f0b0fbcbcb0a69c6219e7673f809d85445 | Triage

Analysis

max time kernel
120s
max time network
138s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:33

Sharing

Report Analysis Logs

General

Target

libisc.dll
Size

472KB
MD5

7e08866be7e8f6db0f982a0482040c09
SHA1

46f6071a51c0f170f6d92c19a0c9658ca4e47930
SHA256

750127c3b72243ad9a4af9e3a27e6f6b4a3dc0544dbbf7743347e32dd0ec18e2
SHA512

9359ffa11e8f21328db20779f4770c457fcd88e38c39e58532b5b831914d93b9f7aa9e89f18ba2e095266218542ee64c49d074ebcb2a3cf7b2923d5a5a676750
SSDEEP

12288:16Lv7Mb75QAwUE7rTb+6W43Z7KTolhQbqKG8E3VKrj:16L4n5/Toluu6Soj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2860	2720	rundll32.exe	29
PID 2720 wrote to memory of 2860	2720	rundll32.exe	29
PID 2720 wrote to memory of 2860	2720	rundll32.exe	29
PID 2720 wrote to memory of 2860	2720	rundll32.exe	29
PID 2720 wrote to memory of 2860	2720	rundll32.exe	29
PID 2720 wrote to memory of 2860	2720	rundll32.exe	29
PID 2720 wrote to memory of 2860	2720	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisc.dll,#1
  2⤵
  PID:2860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2860-0-0x0000000010000000-0x00000000100A3000-memory.dmp

Filesize
652KB

Download
memory/2860-1-0x0000000010000000-0x00000000100A3000-memory.dmp

Filesize
652KB

Download