502f7be59a7abf48fa891add1bf1c8656d5dcacac741b5a3d7c30f889d4fa470

Analysis

max time kernel
122s
max time network
142s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:39

Target

libdns.dll
Size

2.2MB
MD5

f989c514c028867cc1dec79f51e169d6
SHA1

7a8b5450e2989cb8b475e9015e9f8a79e2bc80f3
SHA256

7500a80c7d3c5e31ffb41aba85dcb4c338c07615245e39c4d0de9d18e97246bf
SHA512

d0bc1982d3e9e98ce1ea1c05e647e340d25c3d61a265ef2ed24b638cfe4df7504dabaea285ac11514ee4b2ce79786fb340ab0f98495679ae433ea1bbd04cd943
SSDEEP

24576:BsnJBkK9L0Q51YheGCagiwuoXIwRkOWRm6F+NvCho0uq7V4YKbct5ZJGAwAdKiQZ:B893jYtEuoqCizahPzfsPjqX6e2rE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2672	2768	rundll32.exe	29
PID 2768 wrote to memory of 2672	2768	rundll32.exe	29
PID 2768 wrote to memory of 2672	2768	rundll32.exe	29
PID 2768 wrote to memory of 2672	2768	rundll32.exe	29
PID 2768 wrote to memory of 2672	2768	rundll32.exe	29
PID 2768 wrote to memory of 2672	2768	rundll32.exe	29
PID 2768 wrote to memory of 2672	2768	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
  2⤵
  PID:2672

memory/2672-0-0x0000000010000000-0x0000000010328000-memory.dmp

Filesize
3.2MB

Download
memory/2672-1-0x0000000010000000-0x0000000010328000-memory.dmp

Filesize
3.2MB

Download
memory/2672-2-0x0000000010000000-0x0000000010328000-memory.dmp

Filesize
3.2MB

Download