0ad89051c06b4a5cd4bb2e6c4503adc957d0962b0388e811f07bcaebb4146bac

Analysis

max time kernel
116s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 14:08

Target

libdns.dll
Size

1.7MB
MD5

0464ca2b643cde13691e0b12075c880d
SHA1

9d3ba7a4778f1da1de038880cfc7be1273b078f1
SHA256

e436bac661d346539efca8d84184ad5a399c82bc0fbd5e26082a6f4d05234b9a
SHA512

03db51bf49a14ee22dd4f7046e3d8fc6086bb1c3b5c6fbf89b791b03b7568b5a4f7fa638084c36d3fa58786109a9162d6bb9e7004e7909da0933af3955137239
SSDEEP

24576:9Qq5pQvfQUrr5849PVQv6ecw0FOs+NuIfNqX5CJceQYLdITsJY8FLo+ZQWhKzGsF:j0/rrnwhy5CcAJThKzGsP9x21fy

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 4128	4268	rundll32.exe	89
PID 4268 wrote to memory of 4128	4268	rundll32.exe	89
PID 4268 wrote to memory of 4128	4268	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
  2⤵
  PID:4128

memory/4128-0-0x0000000010000000-0x0000000010267000-memory.dmp

Filesize
2.4MB

Download