4acf1581ad3341dac2f665a455ad97b3dfebe4cb71e4d7332dd11fdc908c1f8e | Triage

Analysis

max time kernel
125s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 14:23

Sharing

Report Analysis Logs

General

Target

libbind9.dll
Size

88KB
MD5

9b668e1f4dbfbcf434cf6f52b8a8c936
SHA1

fcc9cd6f930967026e5fb94f5411bff0627c0aa9
SHA256

1eef80801c2fc69d8afde972262b15ff4083a9814d7e734e580b55b1af82f855
SHA512

81fcc50a8ac3caea8bfb8bee0faa8f313c05afb7985ae730436837583c9b100c11cd1ab5f3608854ba97dc4d9a1089a46a2fb96205207556d20a292362dd2561
SSDEEP

768:QnAHs+LaOs/8DraH1Tx4eQgbBDH2C8yf0nzcsnd4dLmU32y+gjP4y:TZLaO8H1TxvQgdDG5Rd4dLmU32y+gjA

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 4576	5084	rundll32.exe	87
PID 5084 wrote to memory of 4576	5084	rundll32.exe	87
PID 5084 wrote to memory of 4576	5084	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
  2⤵
  PID:4576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4576-0-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download