3a988e442285b36fb8b471da5ff81bd5d1ef2971fc2f991018bf1d51c98e9a20 | Triage

Analysis

max time kernel
138s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 14:03

Sharing

Report Analysis Logs

General

Target

libbind9.dll
Size

68KB
MD5

6d1e4c831891b2b970245ce6f5a4f993
SHA1

36e7fa68cce591cd5dbde32f85c66e7df5fbc07c
SHA256

c3d3fb6da4ea73399cbe4f1e879062d2ce3173b5338f58d53f61052f1eae4d17
SHA512

86547253208043218fe749713c41ca3ea91269579bf1e0a70708ca48ef56255eaa99fd2fa708a07c4202ea587861497bb54bd3e48eccaa1a67dd65e903f19fee
SSDEEP

768:W+ATAE6V6z+CzCJaGUy/T9L4zHE1gpmU3ujP5B:cTAEFzd6F76E1GmU3ujv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 3164	2528	rundll32.exe	83
PID 2528 wrote to memory of 3164	2528	rundll32.exe	83
PID 2528 wrote to memory of 3164	2528	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
  2⤵
  PID:3164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3164-0-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download