2196592d9206a2cb569f62c5b33e8054949bdcea90fd01cbd7174d7954f3a82a | Triage

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:44

Sharing

Report Analysis Logs

General

Target

libbind9.dll
Size

88KB
MD5

e8d9b6e2e8b32b9985f0c627ca83886b
SHA1

c000d44d36434b66ab35beabcde730c8063954ca
SHA256

dddfa0212fd2132ec3dcd5a8299aadaf65b1e14f52c54f0ab4c57242826ae0c1
SHA512

c9f143b939f29cd92540b4b5e838151df567114fc606cbf98e776320117ad3ddd6fe8885c7f2dce9c19b502f9f2d1a3fa54126380f7ea2b5f9dfdace214716a0
SSDEEP

1536:G6seL384WkT1x3nKDxrsV4h9w9LU16uiK:Gdez8lkTLXoW4hwLU1Fi

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 1656	2696	rundll32.exe	28
PID 2696 wrote to memory of 1656	2696	rundll32.exe	28
PID 2696 wrote to memory of 1656	2696	rundll32.exe	28
PID 2696 wrote to memory of 1656	2696	rundll32.exe	28
PID 2696 wrote to memory of 1656	2696	rundll32.exe	28
PID 2696 wrote to memory of 1656	2696	rundll32.exe	28
PID 2696 wrote to memory of 1656	2696	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
  2⤵
  PID:1656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-0-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download