95e0e934fa4af0126102b508db9a798a7f48316873b30e9549d6ba448220fcf4 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:03

Sharing

Report Analysis Logs

General

Target

libdns.dll
Size

2.2MB
MD5

483fd4685cad20695e26dcefe7a0cd70
SHA1

e1dc00e2f996e4c4daff89cce4e29e5aa2585138
SHA256

c114e61d738c3eb4a1a97f0930a8bb09384fd81eda0287d222d3c7602cf9cb02
SHA512

f2e976aaeca0d75d4969fd9aecee9dede133b7be33f7160a9898fc8907b49e0f1526d023cee0960fc4c54165c78349faae0c2eee41338091113e4deaefcc61a5
SSDEEP

49152:cffywAmJ9eBJnI+hDooOV1MTEVvfGsY1SGryMglKGFcFZZJfZC4amfhCzfsPHqp0:cUAzfsPHqpvM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2532	2000	rundll32.exe	28
PID 2000 wrote to memory of 2532	2000	rundll32.exe	28
PID 2000 wrote to memory of 2532	2000	rundll32.exe	28
PID 2000 wrote to memory of 2532	2000	rundll32.exe	28
PID 2000 wrote to memory of 2532	2000	rundll32.exe	28
PID 2000 wrote to memory of 2532	2000	rundll32.exe	28
PID 2000 wrote to memory of 2532	2000	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
  2⤵
  PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2532-0-0x0000000010000000-0x000000001032B000-memory.dmp

Filesize
3.2MB

Download
memory/2532-1-0x0000000010000000-0x000000001032B000-memory.dmp

Filesize
3.2MB

Download
memory/2532-2-0x0000000010000000-0x000000001032B000-memory.dmp

Filesize
3.2MB

Download