17ac44b604ad3450348a5769a851c16abc3b256ea8c5c4e64bb64ac3657b403f

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
09/11/2024, 22:54

Target
2_any_country_dnsredir.cmd
Size 291B
Sample241109-2vqljstja1
SHA256 a7762f252e434134245adee7398eabc7b96e4e83ee408ce63cc3f92b942c4b6b
MD5 48de91946fd423515b182a622842adc5
SHA1 4519a0bc87a0e0838f003d3e4e4904d5721abad7
SHA512 43ef99d5f0ed8725cfad206d6d3bd0d393258872882f3c2fd8f974703dfb418652f9f1adae5b6e9ab769cf9a46192655c795c4ebc0adf4cd6a1b4e7cd20db745
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 3032	2872	cmd.exe	31
PID 2872 wrote to memory of 3032	2872	cmd.exe	31
PID 2872 wrote to memory of 3032	2872	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\2_any_country_dnsredir.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Users\Admin\AppData\Local\Temp\x86_64\goodbyedpi.exe
  goodbyedpi.exe -5 --dns-addr 77.88.8.8 --dns-port 1253 --dnsv6-addr 2a02:6b8::feed:0ff --dnsv6-port 1253
  2⤵
  PID:3032

memory/3032-1-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/3032-0-0x000000013F310000-0x000000013F332000-memory.dmp

Download

memory/3032-4-0x000000013F310000-0x000000013F332000-memory.dmp

Download