c7d95e2b14135ebea824c411c32ff4ba98fa8b5a7a2604e808ffec195e136279 | Triage

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:10

Sharing

Report Analysis Logs

General

Target

libbind9.dll
Size

96KB
MD5

9795608e4de1228e47f927d30ae11338
SHA1

d7fa4702e7c3f060be96d4a211bcb64bd3e08f88
SHA256

959ce8e5d45863af662313f4389da8705b10a2f50f4545e7ab7a4cd981e72ea6
SHA512

7831dc60d32b63c259c2a1cbfb26ac2d7473824852be44f0f1a3eff1c35a8730ee91f33033a0b5450105b29db0fe45bb4146a18a3611ee36463648640306626d
SSDEEP

1536:iJ3toBzeVqx2z7mB9yI2InvCMyWL0JmU5IQPrknN:iJ3t4zeVqx2GB9yI2QvCMyW2mU5IEgN

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2036	1984	rundll32.exe	27
PID 1984 wrote to memory of 2036	1984	rundll32.exe	27
PID 1984 wrote to memory of 2036	1984	rundll32.exe	27
PID 1984 wrote to memory of 2036	1984	rundll32.exe	27
PID 1984 wrote to memory of 2036	1984	rundll32.exe	27
PID 1984 wrote to memory of 2036	1984	rundll32.exe	27
PID 1984 wrote to memory of 2036	1984	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
  2⤵
  PID:2036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/2036-1-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download