95e0e934fa4af0126102b508db9a798a7f48316873b30e9549d6ba448220fcf4 | Triage

Analysis

max time kernel
126s
max time network
222s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:03

Sharing

Report Analysis Logs

General

Target

libbind9.dll
Size

96KB
MD5

1586a11f0a8f7107a2e21e429347eb6b
SHA1

bc2773ea700f6cb9b920f93e9c69eeccb64a5457
SHA256

cff5016e1341e96f9b0e2d45a21336da9185332460a1bd2cc5e00a7d4f3e1904
SHA512

d5737a40b94d769a81300c9ca2db5fd25ddbd782d776d94d15a694539a28f8c3249efb28f129a2aa217d3d67db9fb25257b1291df1633ab4126029cbd445f8b7
SSDEEP

1536:GwRcRrF4Ar7Iu/05qKK1wfSX2yVUmdH7mUNKGUT8rB:GWcVF4Ar7Iu8tKyw2y2mhmUNKLI

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 2168	3436	rundll32.exe	88
PID 3436 wrote to memory of 2168	3436	rundll32.exe	88
PID 3436 wrote to memory of 2168	3436	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
  2⤵
  PID:2168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download