68831ac2a806c5fe6af6920e7f880b1e2fd4f1f9592b749629329a1a461bd571 | Triage

Analysis

max time kernel
161s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:44

Sharing

Report Analysis Logs

General

Target

libbind9.dll
Size

92KB
MD5

2b17d36d45728c5e00c207f9c3c77cd0
SHA1

b24f63e20ea4c18d56748cd9f8fdd9f08625329b
SHA256

b9e6eda2e1995c633868c8806d74a0a052402ad92f4667098b9ea1ad63d269e5
SHA512

2178a3ee48b67d09923c10120ffe3f8a8414c5bf635738f6f1f655a271bab85ec632e3c2867dfc670101404c9add998d128e706ccd12748013cff97a97c0f8b6
SSDEEP

1536:Yl9bU0yVz4t4up34bOG+pZczs2iIeBlzzYmUSvWPrP3:YPbUXqtxp34bORpG/eBymUSvez3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 2228	4264	rundll32.exe	86
PID 4264 wrote to memory of 2228	4264	rundll32.exe	86
PID 4264 wrote to memory of 2228	4264	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
  2⤵
  PID:2228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2228-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download