68831ac2a806c5fe6af6920e7f880b1e2fd4f1f9592b749629329a1a461bd571

Analysis

max time kernel
163s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 14:44

Target

libdns.dll
Size

2.4MB
MD5

8779374c65c3b5c06016f69559bf2274
SHA1

f4b265bb2789f1c6a1f8c32a02d4decebbc71924
SHA256

ecbdaef42257a1528becb0f2fb230daf3fb8111a3e43879bd4cac26fe94db5d6
SHA512

9a889fd46968c4580c9e781bd2347edb2e3c96af91edd4de6fe7a925beb2c95db9e410ee7271c4b67ad3abbfda98618a54ee9c1c4bc359ba219cb9b63117a931
SSDEEP

24576:vU7+EH/toCSTP9J2iq60soeoBwQTUlqHSScJmBCS+hkBPsWdhtgDhvzfsP+tqOvU:aST2inoKReBHQhvzfsP+tqlaqmBw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1864	1976	rundll32.exe	90
PID 1976 wrote to memory of 1864	1976	rundll32.exe	90
PID 1976 wrote to memory of 1864	1976	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
  2⤵
  PID:1864

memory/1864-0-0x0000000010000000-0x0000000010367000-memory.dmp

Filesize
3.4MB

Download