b332bda0f132d11c7e8ada1042126c48ec9353db0379024ccee9d8406df6b13f | Triage

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 04:07

Sharing

Report Analysis Logs

General

Target

3Dfx/Glide.dll
Size

97KB
MD5

8ef23a40c35e3917e97538a4cfbc8fb2
SHA1

0076a1690462e3331ecd2d289afcc061665e42c2
SHA256

84393b6b9a8ab117668aaacda87836588a6d7515328c27fa54d1a85c449123c8
SHA512

39123775b91caaf10f00e3a06fc1018433724b9298010d7626412aab8c19ad8bef993ff79a949529e7b55f38b84efb023eb40d463fca9a3f4c12360b6bfcbcd9
SSDEEP

3072:L3BucMQzSkRZeOGNYFY+KZEPnMa2nUHuWyz:L3Bv7ZeORm5ZEd2NWy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 2152	456	rundll32.exe	19
PID 456 wrote to memory of 2152	456	rundll32.exe	19
PID 456 wrote to memory of 2152	456	rundll32.exe	19

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3Dfx\Glide.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3Dfx\Glide.dll,#1
  2⤵
  PID:2152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2152-0-0x0000000010000000-0x000000001005F000-memory.dmp

Filesize
380KB

Download