b332bda0f132d11c7e8ada1042126c48ec9353db0379024ccee9d8406df6b13f | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 04:07

Sharing

Report Analysis Logs

General

Target

3Dfx/Glide.dll
Size

97KB
MD5

8ef23a40c35e3917e97538a4cfbc8fb2
SHA1

0076a1690462e3331ecd2d289afcc061665e42c2
SHA256

84393b6b9a8ab117668aaacda87836588a6d7515328c27fa54d1a85c449123c8
SHA512

39123775b91caaf10f00e3a06fc1018433724b9298010d7626412aab8c19ad8bef993ff79a949529e7b55f38b84efb023eb40d463fca9a3f4c12360b6bfcbcd9
SSDEEP

3072:L3BucMQzSkRZeOGNYFY+KZEPnMa2nUHuWyz:L3Bv7ZeORm5ZEd2NWy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2536	2444	rundll32.exe	28
PID 2444 wrote to memory of 2536	2444	rundll32.exe	28
PID 2444 wrote to memory of 2536	2444	rundll32.exe	28
PID 2444 wrote to memory of 2536	2444	rundll32.exe	28
PID 2444 wrote to memory of 2536	2444	rundll32.exe	28
PID 2444 wrote to memory of 2536	2444	rundll32.exe	28
PID 2444 wrote to memory of 2536	2444	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3Dfx\Glide.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3Dfx\Glide.dll,#1
  2⤵
  PID:2536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2536-0-0x0000000010000000-0x000000001005F000-memory.dmp

Filesize
380KB

Download
memory/2536-1-0x0000000010000000-0x000000001005F000-memory.dmp

Filesize
380KB

Download
memory/2536-2-0x0000000010000000-0x000000001005F000-memory.dmp

Filesize
380KB

Download