86dabd438734f81d03f76db01608c4f0b0fbcbcb0a69c6219e7673f809d85445 | Triage

Analysis

max time kernel
219s
max time network
292s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 14:33

Sharing

Report Analysis Logs

General

Target

libisccc.dll
Size

72KB
MD5

095943106cff9f4aa03d23ff2233f073
SHA1

cee9db48a6c2af596a14d7bc9365b35ee17edc37
SHA256

7e94b2cc0de82044928c5d0fe962e72979083e567b9e08de330f8a9aee2f9452
SHA512

f584c199863dac59e853583aee3a3f94c85ef759f223f6a33db8b6c80c3d50d96fb05976a5ba3c474b149a703d759362b039475d9711a0caf0a6d079303e210d
SSDEEP

1536:eJbDacohcHdHWlw7bDvYC+8X2m9H3JI8URQuTny2KTjmmUsjFj:2DFohcHdHWlw7PvYC+8X2m13JIvRQuTk

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 2268	3352	rundll32.exe	87
PID 3352 wrote to memory of 2268	3352	rundll32.exe	87
PID 3352 wrote to memory of 2268	3352	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccc.dll,#1
  2⤵
  PID:2268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2268-0-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download