f93e4c97205e62be08bf62fcd18e7a8a163aa0a04525ba30a364dd2fdd5440c2 | Triage

Analysis

max time kernel
139s
max time network
164s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
13/07/2023, 13:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3DSmdBinExport.dll
Size

190KB
MD5

0bd3e7a59f7cd355d62e997af8867241
SHA1

73a1ce2dccca41b94daf98caff5339f0675173f2
SHA256

077717dc9d12286e19d82e8e5513b601b880206e1c2914fd900f12c1c9beeab9
SHA512

1c6f2ce8cf021d62d5844fc932649758fc12f42817060df2ecb317aea8aa6a57364a15216cd981d6ec1edbb1a5574988c76fc5a3d1b44495876918c0a59447fb
SSDEEP

3072:buXdhfxcNVNTv5fpWrgmatNLy7XrT2BrJCAg0FujaOhy+D:StwpxpOgTtIpAO1c+D

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4300	5092	WerFault.exe	69

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 5092	5064	rundll32.exe	69
PID 5064 wrote to memory of 5092	5064	rundll32.exe	69
PID 5064 wrote to memory of 5092	5064	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3DSmdBinExport.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3DSmdBinExport.dll,#1
  2⤵
  PID:5092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 620
    3⤵
    - Program crash
    PID:4300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads