4acf1581ad3341dac2f665a455ad97b3dfebe4cb71e4d7332dd11fdc908c1f8e | Triage

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:23

Sharing

Report Analysis Logs

General

Target

libdns.dll
Size

2.2MB
MD5

b440c8425e0d2a43dba77f6034ff8a35
SHA1

340f605f0d8b3646e3d617399519586af23bedfc
SHA256

5f034bd6e00de5f85a1db796fc295d260196c6b7c24dc96397674b258ab9b041
SHA512

ca6c90e70281e6e26e1994daab688b452386a94a8b4e8f274a74e10fd0f18c983777b6904ab136f3bed93ee276f016ed44eee72f70d7f32276cbe92ade45f2a0
SSDEEP

24576:9QIxvBkD7oSyhcb8cpBoRJhiR0AjsxhUzfsPjkK6tb2TORfMo:XBkD7B0hUzfsPsb2T

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2832	2088	rundll32.exe	29
PID 2088 wrote to memory of 2832	2088	rundll32.exe	29
PID 2088 wrote to memory of 2832	2088	rundll32.exe	29
PID 2088 wrote to memory of 2832	2088	rundll32.exe	29
PID 2088 wrote to memory of 2832	2088	rundll32.exe	29
PID 2088 wrote to memory of 2832	2088	rundll32.exe	29
PID 2088 wrote to memory of 2832	2088	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
  2⤵
  PID:2832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2832-0-0x0000000010000000-0x000000001030F000-memory.dmp

Filesize
3.1MB

Download
memory/2832-1-0x0000000010000000-0x000000001030F000-memory.dmp

Filesize
3.1MB

Download