f058a8196e068c1ee1f4ed9c09d78c32525305f2c58ac578e53d7bafde163d15 | Triage

Analysis

max time kernel
133s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 22:04

Sharing

Report Analysis Logs

General

Target

d3d8thk.dll
Size

8KB
MD5

2b52f185aa373b74eda4e2f7266de085
SHA1

f764a97558f22bcac941dc148f60bc77c5a2cbc8
SHA256

7f50e41a63338072ef1777af711c349cee0f9e9b4b59f2b71330c02fc161d930
SHA512

2a1da2a8d8eeec3235a6b8f84e68ec64a46ba62ff31b123e89a24288800e2443dd2b642ff6af049ec4f600866347304f0b022c8e2ddd60e9bf62694509ec09da
SSDEEP

192:J1mjfw8dHabRDEgzHyl0NSyFWakiP84dW3qWak8Q7dW3o9:J8jhdHad/z20IyFWakC84dWaWak8cdW

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 448	3552	rundll32.exe	89
PID 3552 wrote to memory of 448	3552	rundll32.exe	89
PID 3552 wrote to memory of 448	3552	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3d8thk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3d8thk.dll,#1
  2⤵
  PID:448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads