4036df60e76f069f27da954142060ae81e98d61691a66e6fef567320a9ef4c03 | Triage

Analysis

max time kernel
122s
max time network
137s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:40

Sharing

Report Analysis Logs

General

Target

libdns.dll
Size

2.2MB
MD5

ff2cd1654e278a1ca2ab0232a6179d27
SHA1

f62ff1f150b84f78dde5ca9802155b7d14245466
SHA256

d622acd9156a5e75c84ca43d388fedee9ecd30939447ff6e5402e06fc528d2e3
SHA512

2414109f898afb8aea5f7ceca340170402e6c25d24fc855e35d62c7727488f4e51c3c03e8d676760e28f6bd71d883cd3a162bebcecfa4907b597e7a7fdbecc83
SSDEEP

24576:DzWWtvmFFfJiMEZtEdzFUKEVotc3kr512K/7hMzfsPZJ/oUxm2mMKv:KFfJiMEIdUoO0r2KzhMzfsP7xm2y

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2212	2224	rundll32.exe	28
PID 2224 wrote to memory of 2212	2224	rundll32.exe	28
PID 2224 wrote to memory of 2212	2224	rundll32.exe	28
PID 2224 wrote to memory of 2212	2224	rundll32.exe	28
PID 2224 wrote to memory of 2212	2224	rundll32.exe	28
PID 2224 wrote to memory of 2212	2224	rundll32.exe	28
PID 2224 wrote to memory of 2212	2224	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
  2⤵
  PID:2212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2212-0-0x0000000010000000-0x0000000010320000-memory.dmp

Filesize
3.1MB

Download
memory/2212-1-0x0000000010000000-0x0000000010320000-memory.dmp

Filesize
3.1MB

Download