aa4ff6b03e2b22f226a68619c989741b347bd5d368572cf2b44de9f26391dab4 | Triage

Analysis

max time kernel
177s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:29

Sharing

Report Analysis Logs

General

Target

libdns.dll
Size

2.2MB
MD5

e65d0e10d9693134eca7fca75f30ef5d
SHA1

988d47fa5afc27170041e961fa37c132abce7852
SHA256

b76e590042fb9415f82668571273f01c7d33009517d3fcece36a913ea089469b
SHA512

0097b6e56aa8305da2e8c958c56e7d9d3d835880f0ce3308642d6079f0fbeb5fbcfab555ff2877d6b954780a68987512573e1dbb796890cc410f450ee888cdb7
SSDEEP

24576:8dKoyXbFVBFhZH2xN6QV/vsHoRwBo7xEFH3WRhFDOX2eh7Lgtm70+nh0TahUOKeX:DLTHYX50ibhLzfsPeWmb5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 2356	4764	rundll32.exe	86
PID 4764 wrote to memory of 2356	4764	rundll32.exe	86
PID 4764 wrote to memory of 2356	4764	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
  2⤵
  PID:2356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2356-0-0x0000000010000000-0x0000000010313000-memory.dmp

Filesize
3.1MB

Download