2e1f74e012111fdb4c4090330df1411e960050dd0682de76d5e693ceb2abb8dc

Analysis

max time kernel
135s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:04

Target

libdns.dll
Size

2.4MB
MD5

c38f1ec3e8f6bf87d4c297310cec2bf2
SHA1

27f0daa514826da7def64600d1087651660bafb7
SHA256

ab765e3e1923627193b502f700bd6761ab1698c42ee1df5df37b3e586c96daef
SHA512

0ac3dcedbc9ce917dea06ff471487e21fa341ea877cfa2d273a35330cd42e601d3293d820fb7d11fcb897c5ee283c51004b3d8f034d1953e0dd83159a8e82722
SSDEEP

24576:ETu/ihjPUvRuCs/ytNiq215ZsYsNWQLPzywZ7iry7yePNmoihwzfsPCuqd7fmIjZ:EFUvOsNNnuuNMhwzfsPCuq/jE2Rx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 3112	2744	rundll32.exe	84
PID 2744 wrote to memory of 3112	2744	rundll32.exe	84
PID 2744 wrote to memory of 3112	2744	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
  2⤵
  PID:3112

memory/3112-0-0x0000000010000000-0x000000001036F000-memory.dmp

Filesize
3.4MB

Download