4036df60e76f069f27da954142060ae81e98d61691a66e6fef567320a9ef4c03 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:40

Sharing

Report Analysis Logs

General

Target

libbind9.dll
Size

88KB
MD5

069fd9fae10a16b27f38d93a5b402b16
SHA1

a8913eb52bf1ca9856200add8065a9f76bf37eeb
SHA256

9ebb70d9b966e34b918fdbbc851438dafac4894b5694fccf22e14a5a0e33f612
SHA512

b4ae1294cb6a2a0517b18739a5c24da6d3724ae4ac3c4a31c27c6d478984ef1db9dc5f76fbf6b3f446be1a7ec19ec64dbc904aed468c786d3798f4f580a2accd
SSDEEP

1536:1MMimUCX0YIy5EQDNITRFlTGsIXlGUM54MrO:CMXUCX0YT+QDaRjTLkGUM57y

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2352	1728	rundll32.exe	28
PID 1728 wrote to memory of 2352	1728	rundll32.exe	28
PID 1728 wrote to memory of 2352	1728	rundll32.exe	28
PID 1728 wrote to memory of 2352	1728	rundll32.exe	28
PID 1728 wrote to memory of 2352	1728	rundll32.exe	28
PID 1728 wrote to memory of 2352	1728	rundll32.exe	28
PID 1728 wrote to memory of 2352	1728	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
  2⤵
  PID:2352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2352-0-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download
memory/2352-1-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download
memory/2352-2-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download