4036df60e76f069f27da954142060ae81e98d61691a66e6fef567320a9ef4c03 | Triage

Analysis

max time kernel
145s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:40

Sharing

Report Analysis Logs

General

Target

libdns.dll
Size

2.2MB
MD5

ff2cd1654e278a1ca2ab0232a6179d27
SHA1

f62ff1f150b84f78dde5ca9802155b7d14245466
SHA256

d622acd9156a5e75c84ca43d388fedee9ecd30939447ff6e5402e06fc528d2e3
SHA512

2414109f898afb8aea5f7ceca340170402e6c25d24fc855e35d62c7727488f4e51c3c03e8d676760e28f6bd71d883cd3a162bebcecfa4907b597e7a7fdbecc83
SSDEEP

24576:DzWWtvmFFfJiMEZtEdzFUKEVotc3kr512K/7hMzfsPZJ/oUxm2mMKv:KFfJiMEIdUoO0r2KzhMzfsP7xm2y

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 4964	844	rundll32.exe	87
PID 844 wrote to memory of 4964	844	rundll32.exe	87
PID 844 wrote to memory of 4964	844	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
  2⤵
  PID:4964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4964-0-0x0000000010000000-0x0000000010320000-memory.dmp

Filesize
3.1MB

Download