e962b1f65370f666f8d26dac23b97d6e603fbaf049b5789d834a22e50eeca96e

Analysis

max time kernel
899s
max time network
408s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 04:35

Target
turkey_dnsredir_alternative5_superonline.cmd
Size 302B
Sample260605-e7y25aaz6w
SHA256 e962b1f65370f666f8d26dac23b97d6e603fbaf049b5789d834a22e50eeca96e
MD5 42c1b40ec2532c1da85c95532b8f6418
SHA1 0177dfad6da6965c5b208ace73ae8a31a076382e
SHA512 3372943e609aea7aa4dce5151ba1b2e79273b18119d13e73c11af363d14c1c52d346785087ec6fdc72afcbaffabf95170e8699b1d395233b9e70ad6959de6640
TLSH
T113E0CD3E124D513DB75ED4422098241AF4D9C053AE2649E76139B97017756DFC5C21AE
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
680	Process not Found

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2520	2512	cmd.exe	80

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\turkey_dnsredir_alternative5_superonline.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\x86_64\goodbyedpi.exe
  goodbyedpi.exe -9 --dns-addr 77.88.8.8 --dns-port 1253 --dnsv6-addr 2a02:6b8::feed:0ff --dnsv6-port 1253
  2⤵
  PID:2520

C:\Users\Admin\AppData\Local\Temp\x86_64\WinDivert64.sys
C:\Users\Admin\AppData\Local\Temp\x86_64\WinDivert64.sys
1⤵
PID:4684

memory/2520-0-0x00007FF764080000-0x00007FF7640A2000-memory.dmp

Download

memory/2520-1-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/2520-2-0x00007FF764080000-0x00007FF7640A2000-memory.dmp

Download