19f150e0fe7a3a220fd5333792940cb4dc004dd54de076039c0e9ce4f122826a | Triage

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 13:47

Sharing

Report Analysis Logs

General

Target

libbind9.dll
Size

100KB
MD5

c907721bd5284d4aa0b3c544b446ba17
SHA1

96604e1bb4f5d9b89e5526344049d7ee8ff2f79a
SHA256

6a7467ba2f55dfd6067d04863bb9621aa9a4295740f68d74a4388681191a21d7
SHA512

68bc79aa564128f831dc6d6ee5b71c3026b6796b2b51edd02dd1702402d4d4a602b5207deaca10acbfd6abc69a11563049bbd7c6c192b770042c6f2c48669df3
SSDEEP

1536:pkTkc5NZ4Y1IuY1LzsTwF9o33jwOUvimU0QbGmat:ykc5NZ4h1LwTwFS33MOZmU0O2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2168	2032	rundll32.exe	28
PID 2032 wrote to memory of 2168	2032	rundll32.exe	28
PID 2032 wrote to memory of 2168	2032	rundll32.exe	28
PID 2032 wrote to memory of 2168	2032	rundll32.exe	28
PID 2032 wrote to memory of 2168	2032	rundll32.exe	28
PID 2032 wrote to memory of 2168	2032	rundll32.exe	28
PID 2032 wrote to memory of 2168	2032	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
  2⤵
  PID:2168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-0-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/2168-1-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/2168-2-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download