4acf1581ad3341dac2f665a455ad97b3dfebe4cb71e4d7332dd11fdc908c1f8e | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

libbind9.dll
Size

88KB
MD5

9b668e1f4dbfbcf434cf6f52b8a8c936
SHA1

fcc9cd6f930967026e5fb94f5411bff0627c0aa9
SHA256

1eef80801c2fc69d8afde972262b15ff4083a9814d7e734e580b55b1af82f855
SHA512

81fcc50a8ac3caea8bfb8bee0faa8f313c05afb7985ae730436837583c9b100c11cd1ab5f3608854ba97dc4d9a1089a46a2fb96205207556d20a292362dd2561
SSDEEP

768:QnAHs+LaOs/8DraH1Tx4eQgbBDH2C8yf0nzcsnd4dLmU32y+gjP4y:TZLaO8H1TxvQgdDG5Rd4dLmU32y+gjA

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1872	2244	rundll32.exe	28
PID 2244 wrote to memory of 1872	2244	rundll32.exe	28
PID 2244 wrote to memory of 1872	2244	rundll32.exe	28
PID 2244 wrote to memory of 1872	2244	rundll32.exe	28
PID 2244 wrote to memory of 1872	2244	rundll32.exe	28
PID 2244 wrote to memory of 1872	2244	rundll32.exe	28
PID 2244 wrote to memory of 1872	2244	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
  2⤵
  PID:1872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1872-0-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download
memory/1872-1-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download
memory/1872-2-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download
memory/1872-3-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download