ebef2bf55c4bb7f1327bc62abdc1d90be993efe8e20078550ab63e27efc6b397

Analysis

max time kernel
898s
max time network
456s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 04:35

Target
turkey_dnsredir_alternative3_superonline.cmd
Size 300B
Sample260605-e7y25aaz6w
SHA256 ebef2bf55c4bb7f1327bc62abdc1d90be993efe8e20078550ab63e27efc6b397
MD5 e712f506d9c8c5e3d40f7bf540ffebcb
SHA1 cf2eeb7ecfbb59efb8f8fdf5738623d9b8af50da
SHA512 3d0ccde0b865bade9d75de7b46a968838ebfe03503e73d0ed630b09ee6ae935587b0a0ad1bc6c54b6e7ffc8e065f9b1141ed31e256120f9dc67711025b7b84fe
TLSH
T119E07D3E03CC61BCF78ED01120282002B4D4D0176E31A6E2A478B5302B263DF84C1159
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
672	Process not Found

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2012	1992	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\turkey_dnsredir_alternative3_superonline.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\x86_64\goodbyedpi.exe
  goodbyedpi.exe --set-ttl 3 --dns-addr 77.88.8.8 --dns-port 1253 --dnsv6-addr 2a02:6b8::feed:0ff --dnsv6-port 1253
  2⤵
  PID:2012

C:\Users\Admin\AppData\Local\Temp\x86_64\WinDivert64.sys
C:\Users\Admin\AppData\Local\Temp\x86_64\WinDivert64.sys
1⤵
PID:4816

memory/2012-1-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/2012-0-0x00007FF7774D0000-0x00007FF7774F2000-memory.dmp

Download

memory/2012-2-0x00007FF7774D0000-0x00007FF7774F2000-memory.dmp

Download