d9b9820b03a2081f5575b05314fc7298b8a7d37250d40da04614e683607fd95f | Triage

Analysis

max time kernel
120s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:33

Sharing

Report Analysis Logs

General

Target

libdns.dll
Size

2.3MB
MD5

b255d82772b1e514c2f7606a495e3832
SHA1

b96545989707149bf4041c24be8161060071c3c3
SHA256

6a6bb14989de6beecdc3b9f5df20c9543149412883c738c2539ecf7acdb1405a
SHA512

97f370901302311ec3ec2aa484704cc2c6846c7a179f38d2eccbceb3456042173f6cb26c9142f9e7632f3fe5826fc0f64583e2362a45768106a118a66c85b4a4
SSDEEP

24576:iEhnCRsaAN4pSAYzYYY6sdWkKJbhqMR45AcalDhyzfsP6IqfgSnNlsmQsQ7:wXy4pSBV9hyzfsP6IqJlsmQs

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 2244	1156	rundll32.exe	27
PID 1156 wrote to memory of 2244	1156	rundll32.exe	27
PID 1156 wrote to memory of 2244	1156	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdns.dll,#1
  2⤵
  PID:2244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2244-0-0x0000000010000000-0x0000000010347000-memory.dmp

Filesize
3.3MB

Download