b332bda0f132d11c7e8ada1042126c48ec9353db0379024ccee9d8406df6b13f | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27-01-2024 04:07

Sharing

Report Analysis Logs

General

Target

3Dfx/Glide2x.dll
Size

96KB
MD5

3f30f9a239496320700023eb9bea4e6a
SHA1

341084968477f10cc73edf28a1ebb8237fbf0cca
SHA256

9f3494301fd2ba97e8ff6d607ef73a38db772e2946b5646ec984dd7bac772898
SHA512

203dda81a04fc6a01107ef8dceeea01625145dcf281881217962dfb31ef7d86a01c3849925ee70b8bec03e2d5e672d1af02f5a93b112a2f86a82a3f7e98b5331
SSDEEP

1536:git4fDtX7+R79aUDYGMIzBYKfrwCd3MpwSYEIOaQ7qPWKDm00LFt:r4xX7s9aLGzNTwfw6yQ7QWgm0Ot

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 456	1528	rundll32.exe	15
PID 1528 wrote to memory of 456	1528	rundll32.exe	15
PID 1528 wrote to memory of 456	1528	rundll32.exe	15
PID 1528 wrote to memory of 456	1528	rundll32.exe	15
PID 1528 wrote to memory of 456	1528	rundll32.exe	15
PID 1528 wrote to memory of 456	1528	rundll32.exe	15
PID 1528 wrote to memory of 456	1528	rundll32.exe	15

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3Dfx\Glide2x.dll,#1
1⤵
PID:456

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3Dfx\Glide2x.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/456-0-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/456-1-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download
memory/456-2-0x0000000010000000-0x000000001005E000-memory.dmp

Filesize
376KB

Download