929437f507f93afe723a8cde00a677b3baf841fde99281cb1274a3355b202312 | Triage

Analysis

max time kernel
118s
max time network
144s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 13:42

Sharing

Report Analysis Logs

General

Target

libbind9.dll
Size

96KB
MD5

867969070db62df83e509c567e5f4c65
SHA1

2b157b998120cadda648acfe20af033b6d276fc8
SHA256

c810ccc47291dfaad4dd323f445b34ee344d13dc0009e9ce2e28da3b72ac2181
SHA512

b64a28902b66384acf1e124ea041374e3a5b05a0d640a23e35f2c728e2394ca0b8178bf2384a43e5d215f732960e95a9f91e470deff38efd593d15fe140687dd
SSDEEP

1536:v3aEfdZKL6/yQyCCka6lJ3HRl6SgmUIJjPr:v3aEfdZc6Zyr6H3HRl0mUIJb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2144	2872	rundll32.exe	28
PID 2872 wrote to memory of 2144	2872	rundll32.exe	28
PID 2872 wrote to memory of 2144	2872	rundll32.exe	28
PID 2872 wrote to memory of 2144	2872	rundll32.exe	28
PID 2872 wrote to memory of 2144	2872	rundll32.exe	28
PID 2872 wrote to memory of 2144	2872	rundll32.exe	28
PID 2872 wrote to memory of 2144	2872	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
  2⤵
  PID:2144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2144-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/2144-1-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/2144-2-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download