4acf1581ad3341dac2f665a455ad97b3dfebe4cb71e4d7332dd11fdc908c1f8e | Triage

Analysis

max time kernel
257s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

libdns.dll
Size

2.2MB
MD5

b440c8425e0d2a43dba77f6034ff8a35
SHA1

340f605f0d8b3646e3d617399519586af23bedfc
SHA256

5f034bd6e00de5f85a1db796fc295d260196c6b7c24dc96397674b258ab9b041
SHA512

ca6c90e70281e6e26e1994daab688b452386a94a8b4e8f274a74e10fd0f18c983777b6904ab136f3bed93ee276f016ed44eee72f70d7f32276cbe92ade45f2a0
SSDEEP

24576:9QIxvBkD7oSyhcb8cpBoRJhiR0AjsxhUzfsPjkK6tb2TORfMo:XBkD7B0hUzfsPsb2T

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 1816	636	rundll32.exe	86
PID 636 wrote to memory of 1816	636	rundll32.exe	86
PID 636 wrote to memory of 1816	636	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
  2⤵
  PID:1816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1816-0-0x0000000010000000-0x000000001030F000-memory.dmp

Filesize
3.1MB

Download
memory/1816-1-0x0000000010000000-0x000000001030F000-memory.dmp

Filesize
3.1MB

Download