9d6c768971be9db529ec35a55b599b8bc8ccce9f2778c8f521796fa6b0a318d7

Analysis

max time kernel
899s
max time network
449s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 04:35

Target
turkey_dnsredir_alternative4_superonline.cmd
Size 302B
Sample260605-e7y25aaz6w
SHA256 9d6c768971be9db529ec35a55b599b8bc8ccce9f2778c8f521796fa6b0a318d7
MD5 c67418e03096b645a2f28b5b44fd7ee5
SHA1 5f40c0e9d24d7d37da6bd84114422bfb278d42b2
SHA512 bea723feadfd8ca4a1535caa0df2ffba76133fd1a984911afa9135cc8323f8f4c16fbe31077c68c54df659120d1b752da55803a6d7c895761d8861035dbbeb85
TLSH
T16AE0CD3E124D513DB75ED4422098241AF4D9C053AE2549D7A138B57017756DFC5C21AE
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
696	Process not Found

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 3828	2224	cmd.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\turkey_dnsredir_alternative4_superonline.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\x86_64\goodbyedpi.exe
  goodbyedpi.exe -5 --dns-addr 77.88.8.8 --dns-port 1253 --dnsv6-addr 2a02:6b8::feed:0ff --dnsv6-port 1253
  2⤵
  PID:3828

C:\Users\Admin\AppData\Local\Temp\x86_64\WinDivert64.sys
C:\Users\Admin\AppData\Local\Temp\x86_64\WinDivert64.sys
1⤵
PID:2504

memory/3828-1-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/3828-0-0x00007FF7DB020000-0x00007FF7DB042000-memory.dmp

Download

memory/3828-2-0x00007FF7DB020000-0x00007FF7DB042000-memory.dmp

Download