d9b9820b03a2081f5575b05314fc7298b8a7d37250d40da04614e683607fd95f | Triage

Analysis

max time kernel
136s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:33

Sharing

Report Analysis Logs

General

Target

libbind9.dll
Size

100KB
MD5

12c2dc6f1ab21ff548f3005b17e84002
SHA1

599c686941f39392601e403053953c18903b6f8b
SHA256

5322f3d5c686901ced7d7973fce71d0f404b2ee7bed853c1ca249d842dceaf56
SHA512

5f25c5281cf6517e5b0369c7bb46f32e276a478861de81dc8619a5b1ea73d463c550e9866de6f70b8043d126e78b0b3fde3fdd37f3101eebc4b17c00e46761d8
SSDEEP

1536:5k/8kJVZ4ARI6s1LXITMRhg3PTzOOcSmUIN3GmaV:28kJVZ4F1LYTMRu3PnOkmUId+

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 2256	4676	rundll32.exe	85
PID 4676 wrote to memory of 2256	4676	rundll32.exe	85
PID 4676 wrote to memory of 2256	4676	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbind9.dll,#1
  2⤵
  PID:2256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2256-0-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download