add2d2999ed2b5f9ba6bcf8f851b8df8c102161d8436b80bd8ce67794c67b79e

Analysis

max time kernel
139s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2023 20:19

Target

3D Analyzer 2.37/3D Analyze/hook_3DA.dll
Size

88KB
MD5

6e20f79419ce2adb43b708d1c6aa8e62
SHA1

92e285cbc8b78d71aba782297ba97f567b61e4e1
SHA256

96f136674ead7b4ae971a332e0e06b4f3a7afab49f2b9a566aad3f36eb1b6a1f
SHA512

eec074f5a8e455e3a94505400a3742f7c06039299008727da569d7e6ca1b7d4b722c1a52bc7f14470dcf0dc56afb880da3c1480b92b50128460611c7354b56c0
SSDEEP

1536:+ihSdZYnHFYZEu9nDJXloR4/UwcvCDxHE1CE:rk6WOuh8R4/UwcvCDxHE1C

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 3832	4872	rundll32.exe	83
PID 4872 wrote to memory of 3832	4872	rundll32.exe	83
PID 4872 wrote to memory of 3832	4872	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\3D Analyzer 2.37\3D Analyze\hook_3DA.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\3D Analyzer 2.37\3D Analyze\hook_3DA.dll",#1
  2⤵
  PID:3832

memory/3832-0-0x0000000000FE0000-0x0000000000FF0000-memory.dmp

Filesize
64KB

Download
memory/3832-1-0x0000000000FE0000-0x0000000000FF0000-memory.dmp

Filesize
64KB

Download
memory/3832-2-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/3832-3-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/3832-4-0x0000000076FF0000-0x00000000770E0000-memory.dmp

Filesize
960KB

Download
memory/3832-5-0x0000000076FF0000-0x00000000770E0000-memory.dmp

Filesize
960KB

Download
memory/3832-6-0x0000000076FF0000-0x00000000770E0000-memory.dmp

Filesize
960KB

Download