9227fd96951a6422a0bd8dd93579e191c880b2f05eaa52606f58bd1615509480 | Triage

Analysis

max time kernel
120s
max time network
140s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:25

Sharing

Report Analysis Logs

General

Target

libdns.dll
Size

2.0MB
MD5

4dbe4485dc5cb325185da9268831209b
SHA1

b0d0441c29276d6f66f06d01872b7832d78d293d
SHA256

024d7ccfd27b4104595a1a2fcfa1838052581fe4dc02a7962a878925591aef64
SHA512

b96ad5cdecbcd4cf8f0efb67ff8d3c6946e2676e72ab00526c67efcc70dcfb1c42c723f605e29f831eec67fbcd4454f8695208be4fdee9eb36c0c191f653df9e
SSDEEP

24576:yfWBr5pDdkRki+lABieddgMoqItUmE0nU5QhPzfsPoDxzymmuMSoc:nA+lEi/7UmED+hPzfsPFmmur

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 3020	3012	rundll32.exe	28
PID 3012 wrote to memory of 3020	3012	rundll32.exe	28
PID 3012 wrote to memory of 3020	3012	rundll32.exe	28
PID 3012 wrote to memory of 3020	3012	rundll32.exe	28
PID 3012 wrote to memory of 3020	3012	rundll32.exe	28
PID 3012 wrote to memory of 3020	3012	rundll32.exe	28
PID 3012 wrote to memory of 3020	3012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
  2⤵
  PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3020-0-0x0000000010000000-0x00000000102CD000-memory.dmp

Filesize
2.8MB

Download
memory/3020-1-0x0000000010000000-0x00000000102CD000-memory.dmp

Filesize
2.8MB

Download