add2d2999ed2b5f9ba6bcf8f851b8df8c102161d8436b80bd8ce67794c67b79e | Triage

Analysis

max time kernel
122s
max time network
147s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 20:19

Sharing

Report Analysis Logs

General

Target

3D Analyzer 2.37/3D Analyze/ForceDLL.dll
Size

51KB
MD5

9df69d424e0679a582423dd68dfc9511
SHA1

f734d8b64e4645bd907d2fab610d4aafe9160e83
SHA256

b0a51d4737f2b5cd6de6863f556063ea7c41753229cd024831015c87deb0564a
SHA512

802d106a6ceb475f8bb95a343961ade273e98925149e4a449e16d1c11f8463403aa27da98f9057f25ce40a1db93f617837e026b5841f0eeec6b89f71c53800f3
SSDEEP

1536:td3x5CnSMOMaL6UsLYX2QXlodKsNDXavB:X36VON6N62XdbNDqZ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2620	2596	rundll32.exe	28
PID 2596 wrote to memory of 2620	2596	rundll32.exe	28
PID 2596 wrote to memory of 2620	2596	rundll32.exe	28
PID 2596 wrote to memory of 2620	2596	rundll32.exe	28
PID 2596 wrote to memory of 2620	2596	rundll32.exe	28
PID 2596 wrote to memory of 2620	2596	rundll32.exe	28
PID 2596 wrote to memory of 2620	2596	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\3D Analyzer 2.37\3D Analyze\ForceDLL.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\3D Analyzer 2.37\3D Analyze\ForceDLL.dll",#1
  2⤵
  PID:2620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2620-0-0x00000000001A0000-0x00000000001B0000-memory.dmp

Filesize
64KB

Download
memory/2620-1-0x00000000001A0000-0x00000000001B0000-memory.dmp

Filesize
64KB

Download