145fcc8cd93c6c238c1529968588cdbe9ec071c272d1f86e2f3972dc27f9d705

Analysis

max time kernel
130s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2023 04:20

Target

external/dgVoodoo2/3Dfx/x86/Glide2x.dll
Size

190KB
MD5

5ee5eae3f97d2b8449566b386e836d89
SHA1

1fe81364be20ca34dd031a9f4705107bb7a996bd
SHA256

13c3b025350332199503dd1585f76a7802d260e60b2b173264c0418482e06387
SHA512

24b28757a15132b713c5e41cc1ba520925645e43eaa4e15e59bda5d330efba4f9adeb9ca1d4281979c10ef9e91fe8183771aafa692b24abf2785a099748e818e
SSDEEP

3072:Mi56WOy7uQwZHMV47VgOkuDhd0/XsQQ3A3tCtJNGUpFTIctpTDMHLvk9SlAjOUlj:UWO3RHMgVzd0P/IA3tlUDTRxMHLXijOy

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 1964	4916	rundll32.exe	79
PID 4916 wrote to memory of 1964	4916	rundll32.exe	79
PID 4916 wrote to memory of 1964	4916	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\external\dgVoodoo2\3Dfx\x86\Glide2x.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\external\dgVoodoo2\3Dfx\x86\Glide2x.dll,#1
  2⤵
  PID:1964