0ad89051c06b4a5cd4bb2e6c4503adc957d0962b0388e811f07bcaebb4146bac | Triage

Analysis

max time kernel
129s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:08

Sharing

Report Analysis Logs

General

Target

libbind9.dll
Size

68KB
MD5

3ec07556c11601fef21123e74152326a
SHA1

9aef62ecc9eebb8c3414ce7824036305e98d8b01
SHA256

6212741b80849344ca5c5ceba7fd2c2d1dc1060a220e7b7964670a39666ce416
SHA512

fa6c28da307ec1fc2f05083b0caf08cfc32a5a11b6e22f1eb2219024f8064eaff37247b55fd3e2b5faf756cd03232d702f92f6c175879e981250a93d37f66917
SSDEEP

768:WYjjA0KVaiwDq4p8CeUuPRrDzz1G/GUyojP5B:rjA0Vi8URx1aGUyojv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 4580	5000	rundll32.exe	86
PID 5000 wrote to memory of 4580	5000	rundll32.exe	86
PID 5000 wrote to memory of 4580	5000	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
  2⤵
  PID:4580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4580-0-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download