68831ac2a806c5fe6af6920e7f880b1e2fd4f1f9592b749629329a1a461bd571

Analysis

max time kernel
278s
max time network
320s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:44

Target

libdns.dll
Size

2.4MB
MD5

8779374c65c3b5c06016f69559bf2274
SHA1

f4b265bb2789f1c6a1f8c32a02d4decebbc71924
SHA256

ecbdaef42257a1528becb0f2fb230daf3fb8111a3e43879bd4cac26fe94db5d6
SHA512

9a889fd46968c4580c9e781bd2347edb2e3c96af91edd4de6fe7a925beb2c95db9e410ee7271c4b67ad3abbfda98618a54ee9c1c4bc359ba219cb9b63117a931
SSDEEP

24576:vU7+EH/toCSTP9J2iq60soeoBwQTUlqHSScJmBCS+hkBPsWdhtgDhvzfsP+tqOvU:aST2inoKReBHQhvzfsP+tqlaqmBw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2516	2028	rundll32.exe	28
PID 2028 wrote to memory of 2516	2028	rundll32.exe	28
PID 2028 wrote to memory of 2516	2028	rundll32.exe	28
PID 2028 wrote to memory of 2516	2028	rundll32.exe	28
PID 2028 wrote to memory of 2516	2028	rundll32.exe	28
PID 2028 wrote to memory of 2516	2028	rundll32.exe	28
PID 2028 wrote to memory of 2516	2028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
  2⤵
  PID:2516

memory/2516-0-0x0000000010000000-0x0000000010367000-memory.dmp

Filesize
3.4MB

Download
memory/2516-1-0x0000000010000000-0x0000000010367000-memory.dmp

Filesize
3.4MB

Download
memory/2516-3-0x0000000010000000-0x0000000010367000-memory.dmp

Filesize
3.4MB

Download
memory/2516-2-0x0000000010000000-0x0000000010367000-memory.dmp

Filesize
3.4MB

Download