b332bda0f132d11c7e8ada1042126c48ec9353db0379024ccee9d8406df6b13f | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27-01-2024 04:07

Sharing

Report Analysis Logs

General

Target

MS/D3DImm.dll
Size

90KB
MD5

6ecc47cc74b844c64c6aded8dd76d5fb
SHA1

050dcbff53a2f7c3449cd60e39a98dbbc9f5d56d
SHA256

beb0fcc245a466573303862c6fd6a3a4dc6747681d8c8304637c17fccc72e422
SHA512

df8d49db19f264d6d7146d457152e720e9f9647a108d547be362ab9fe7239215c1f27679211b6b72dc38646289260de5a479186f31c0d97bfa030b59b8cd1b0c
SSDEEP

1536:V9f3FRRRDL0EagiyABdTyI+glmUejWTzoTW6ywOCaEupJTU55Zj9jT6NtT:Hf1RnL0EagMRTzLVEwJW5ZjZeZ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 624	1764	rundll32.exe	16
PID 1764 wrote to memory of 624	1764	rundll32.exe	16
PID 1764 wrote to memory of 624	1764	rundll32.exe	16
PID 1764 wrote to memory of 624	1764	rundll32.exe	16
PID 1764 wrote to memory of 624	1764	rundll32.exe	16
PID 1764 wrote to memory of 624	1764	rundll32.exe	16
PID 1764 wrote to memory of 624	1764	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MS\D3DImm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MS\D3DImm.dll,#1
  2⤵
  PID:624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/624-1-0x0000000010000000-0x000000001008E000-memory.dmp

Filesize
568KB

Download
memory/624-0-0x0000000010000000-0x000000001008E000-memory.dmp

Filesize
568KB

Download
memory/624-2-0x0000000010000000-0x000000001008E000-memory.dmp

Filesize
568KB

Download