b1961df58e25db76e6d2c22b582a97a1cb135800a4878466e8d1fa6f10c63e22

Analysis

user interaction
yes
max time kernel
900s
max time network
465s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 04:35

Target
turkey_dnsredir.cmd
Size 303B
Sample260605-e7y25aaz6w
SHA256 b1961df58e25db76e6d2c22b582a97a1cb135800a4878466e8d1fa6f10c63e22
MD5 775a903331912fd9867a99b994e1b859
SHA1 54c9e428e4a178b9ab1c720387703c204ff18245
SHA512 c92a86261a6b6879061995b6e8b00ffb20307af9d7f6dac7434d4a159b388a1aad48ae984ecd80aa7a1b7ae5516dc80967822c6c43bdb8192c9cd30e14b22035
TLSH
T1E8E07D3E03CC517CF78ED10120282002F4D5D0176E31A6E6A4B8B5301B263DFC4C1159
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 2412	956	cmd.exe	80

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\turkey_dnsredir.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Users\Admin\AppData\Local\Temp\x86_64\goodbyedpi.exe
  goodbyedpi.exe -5 --set-ttl 5 --dns-addr 77.88.8.8 --dns-port 1253 --dnsv6-addr 2a02:6b8::feed:0ff --dnsv6-port 1253
  2⤵
  PID:2412

C:\Users\Admin\AppData\Local\Temp\x86_64\WinDivert64.sys
C:\Users\Admin\AppData\Local\Temp\x86_64\WinDivert64.sys
1⤵
PID:4280

memory/2412-0-0x00007FF727480000-0x00007FF7274A2000-memory.dmp

Download

memory/2412-1-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/2412-2-0x00007FF727480000-0x00007FF7274A2000-memory.dmp

Download