95e0e934fa4af0126102b508db9a798a7f48316873b30e9549d6ba448220fcf4 | Triage

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:03

Sharing

Report Analysis Logs

General

Target

libbind9.dll
Size

96KB
MD5

1586a11f0a8f7107a2e21e429347eb6b
SHA1

bc2773ea700f6cb9b920f93e9c69eeccb64a5457
SHA256

cff5016e1341e96f9b0e2d45a21336da9185332460a1bd2cc5e00a7d4f3e1904
SHA512

d5737a40b94d769a81300c9ca2db5fd25ddbd782d776d94d15a694539a28f8c3249efb28f129a2aa217d3d67db9fb25257b1291df1633ab4126029cbd445f8b7
SSDEEP

1536:GwRcRrF4Ar7Iu/05qKK1wfSX2yVUmdH7mUNKGUT8rB:GWcVF4Ar7Iu8tKyw2y2mhmUNKLI

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2268	1936	rundll32.exe	28
PID 1936 wrote to memory of 2268	1936	rundll32.exe	28
PID 1936 wrote to memory of 2268	1936	rundll32.exe	28
PID 1936 wrote to memory of 2268	1936	rundll32.exe	28
PID 1936 wrote to memory of 2268	1936	rundll32.exe	28
PID 1936 wrote to memory of 2268	1936	rundll32.exe	28
PID 1936 wrote to memory of 2268	1936	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
  2⤵
  PID:2268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2268-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download