add2d2999ed2b5f9ba6bcf8f851b8df8c102161d8436b80bd8ce67794c67b79e | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 20:19

Sharing

Report Analysis Logs

General

Target

3D Analyzer 2.37/3D Analyze/hook_3DA.dll
Size

88KB
MD5

6e20f79419ce2adb43b708d1c6aa8e62
SHA1

92e285cbc8b78d71aba782297ba97f567b61e4e1
SHA256

96f136674ead7b4ae971a332e0e06b4f3a7afab49f2b9a566aad3f36eb1b6a1f
SHA512

eec074f5a8e455e3a94505400a3742f7c06039299008727da569d7e6ca1b7d4b722c1a52bc7f14470dcf0dc56afb880da3c1480b92b50128460611c7354b56c0
SSDEEP

1536:+ihSdZYnHFYZEu9nDJXloR4/UwcvCDxHE1CE:rk6WOuh8R4/UwcvCDxHE1C

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 2160	532	rundll32.exe	28
PID 532 wrote to memory of 2160	532	rundll32.exe	28
PID 532 wrote to memory of 2160	532	rundll32.exe	28
PID 532 wrote to memory of 2160	532	rundll32.exe	28
PID 532 wrote to memory of 2160	532	rundll32.exe	28
PID 532 wrote to memory of 2160	532	rundll32.exe	28
PID 532 wrote to memory of 2160	532	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\3D Analyzer 2.37\3D Analyze\hook_3DA.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\3D Analyzer 2.37\3D Analyze\hook_3DA.dll",#1
  2⤵
  PID:2160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2160-0-0x0000000000130000-0x0000000000140000-memory.dmp

Filesize
64KB

Download
memory/2160-1-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/2160-2-0x0000000076230000-0x0000000076340000-memory.dmp

Filesize
1.1MB

Download
memory/2160-3-0x0000000076230000-0x0000000076340000-memory.dmp

Filesize
1.1MB

Download