929437f507f93afe723a8cde00a677b3baf841fde99281cb1274a3355b202312 | Triage

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 13:42

Sharing

Report Analysis Logs

General

Target

libbind9.dll
Size

96KB
MD5

867969070db62df83e509c567e5f4c65
SHA1

2b157b998120cadda648acfe20af033b6d276fc8
SHA256

c810ccc47291dfaad4dd323f445b34ee344d13dc0009e9ce2e28da3b72ac2181
SHA512

b64a28902b66384acf1e124ea041374e3a5b05a0d640a23e35f2c728e2394ca0b8178bf2384a43e5d215f732960e95a9f91e470deff38efd593d15fe140687dd
SSDEEP

1536:v3aEfdZKL6/yQyCCka6lJ3HRl6SgmUIJjPr:v3aEfdZc6Zyr6H3HRl0mUIJb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 692	2064	rundll32.exe	88
PID 2064 wrote to memory of 692	2064	rundll32.exe	88
PID 2064 wrote to memory of 692	2064	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
  2⤵
  PID:692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/692-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download