3a988e442285b36fb8b471da5ff81bd5d1ef2971fc2f991018bf1d51c98e9a20 | Triage

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:03

Sharing

Report Analysis Logs

General

Target

libdns.dll
Size

1.7MB
MD5

d33ff4828ff1d2ee9cd819713913588a
SHA1

972e1c68a1e1d277e9c65ebde3ea105ff0539349
SHA256

069fc5a23bd78faf6cd70f4d8cca0961b1ab5865cb70cfc657f4d8c643bff5d5
SHA512

61df5d89d8d9637fdf2be3e36957af34dc0025cd8bc75219cd0720e239ba936894505b677543d0adff5e35dbeb0254d55be334364862a85d5445443bce2f0431
SSDEEP

24576:96czLcFZcUIqdheg32EApSap97XqTc9pIhNzGsPnqSanJ21JkvcY:qHleg3I1qT4mhNzGsPQJ21WD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2128	2144	rundll32.exe	27
PID 2144 wrote to memory of 2128	2144	rundll32.exe	27
PID 2144 wrote to memory of 2128	2144	rundll32.exe	27
PID 2144 wrote to memory of 2128	2144	rundll32.exe	27
PID 2144 wrote to memory of 2128	2144	rundll32.exe	27
PID 2144 wrote to memory of 2128	2144	rundll32.exe	27
PID 2144 wrote to memory of 2128	2144	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
  2⤵
  PID:2128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2128-0-0x0000000010000000-0x0000000010269000-memory.dmp

Filesize
2.4MB

Download
memory/2128-1-0x0000000010000000-0x0000000010269000-memory.dmp

Filesize
2.4MB

Download