929437f507f93afe723a8cde00a677b3baf841fde99281cb1274a3355b202312 | Triage

Analysis

max time kernel
145s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 13:42

Sharing

Report Analysis Logs

General

Target

libdns.dll
Size

2.5MB
MD5

95914ef8c6b4e0d3324817539c8a533b
SHA1

1461d90a235e7cffc45e0aa775b64a44fa506fb8
SHA256

840842f7dbcae82912d43d7c13072b26c0f83fb203c7151aaffa62e97dd01d4d
SHA512

c14fcc4ac7871c85a1338b75f2be6865cbb8374d401e04c6c9611df72b3140e5d43d7bdc1689ee4fc6a59b969d9d3284538369b5504331e77e3b452ae43d634e
SSDEEP

49152:G/XpR3qa3uK8cy3o7ohfzfsP2tqkSGmrNy:hYAzfsP2tqkSrNy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 5016	4844	rundll32.exe	88
PID 4844 wrote to memory of 5016	4844	rundll32.exe	88
PID 4844 wrote to memory of 5016	4844	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
  2⤵
  PID:5016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5016-0-0x0000000010000000-0x0000000010389000-memory.dmp

Filesize
3.5MB

Download