b332bda0f132d11c7e8ada1042126c48ec9353db0379024ccee9d8406df6b13f | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 04:07

Sharing

Report Analysis Logs

General

Target

3Dfx/Glide3x.dll
Size

99KB
MD5

0122a1ac0b8e2a50ffdd5bcb4da7a240
SHA1

127ff5c40f194c05cc6a4f023850951ac1d88cfa
SHA256

ed951ce24bad7b9da4d2a6383c7e3043ac55c44bb37fd6e5d34a0d78ff0d0047
SHA512

150da2620d21bec97a2ba882704a2fc0f56d705334d126088eb17a174bce5a25afcbfd1f838af7299a5b76977f3f438d8d57f72c15be26654d4001e4961206c5
SSDEEP

3072:gaEBqxa3lq41VMq7HpdZZXEqFQN6C7LgkTKLYSgV4AvRYz:grV13Mq7HdZXa7Lgk2UxZvy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 2540	1444	rundll32.exe	28
PID 1444 wrote to memory of 2540	1444	rundll32.exe	28
PID 1444 wrote to memory of 2540	1444	rundll32.exe	28
PID 1444 wrote to memory of 2540	1444	rundll32.exe	28
PID 1444 wrote to memory of 2540	1444	rundll32.exe	28
PID 1444 wrote to memory of 2540	1444	rundll32.exe	28
PID 1444 wrote to memory of 2540	1444	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3Dfx\Glide3x.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3Dfx\Glide3x.dll,#1
  2⤵
  PID:2540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2540-0-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download
memory/2540-1-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download
memory/2540-2-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download