c7d95e2b14135ebea824c411c32ff4ba98fa8b5a7a2604e808ffec195e136279

Analysis

max time kernel
179s
max time network
311s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 14:10

Target

libdns.dll
Size

2.4MB
MD5

f79757788cc3cbd0b9d444d2ac2bd50b
SHA1

c7b969fa8f71204c2fd0e0041c405cdfd5dcfc73
SHA256

1d7bc1fb09351ff9a123e138b55c61ea36238c8995879d167bc39d85a4bd8343
SHA512

006b952b259a3feae8fe3a3d7a74a5aa2ee0b464500319678e0b5c8200a1507fb56614c910e290d8e9e209abd3c658827aaeaacc8c8e851c27b977c70bb5b8db
SSDEEP

24576:aZYyRS7caZVBXDDGAPGLUDPgBEB8TQhK0229tYN19mj1wHZizavk3DSOPwrplOX2:VZH5echKSVNDLhh/zfsPuyqrLK2XJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 5080	2008	rundll32.exe	22
PID 2008 wrote to memory of 5080	2008	rundll32.exe	22
PID 2008 wrote to memory of 5080	2008	rundll32.exe	22

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
  2⤵
  PID:5080

memory/5080-0-0x0000000010000000-0x000000001036D000-memory.dmp

Filesize
3.4MB

Download