86dabd438734f81d03f76db01608c4f0b0fbcbcb0a69c6219e7673f809d85445 | Triage

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:33

Sharing

Report Analysis Logs

General

Target

libisccfg.dll
Size

116KB
MD5

06ef8208daa86b7020a71260abba538b
SHA1

a02fd40cd868ef53cafa5402617a054995738bcc
SHA256

91fd9b472275b3e74b7ba8ffeeed5b1aaaa20d4b27acdf1e73b5ee46e79f9b35
SHA512

7e0482784cefe0e57ed8bad90173af18ec5b4b983896b6143e719b2cbe6385d8e2b3d6f27a5909704cbeed065e9879baff0e9df046df86e4ec4663abc9f1fdd0
SSDEEP

1536:q1SZX7I0LVZookosQjsEy890jIKXsQGU0opYQcjwlbwH:qYZX79LVZ4pQM890jIuGU0hUlbw

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2744	2896	rundll32.exe	29
PID 2896 wrote to memory of 2744	2896	rundll32.exe	29
PID 2896 wrote to memory of 2744	2896	rundll32.exe	29
PID 2896 wrote to memory of 2744	2896	rundll32.exe	29
PID 2896 wrote to memory of 2744	2896	rundll32.exe	29
PID 2896 wrote to memory of 2744	2896	rundll32.exe	29
PID 2896 wrote to memory of 2744	2896	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccfg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libisccfg.dll,#1
  2⤵
  PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2744-0-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download