add606aed192fefaf9b3932d4d650c5ecc5bbe4bce547c6e075ae8d7d7200a31 | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 21:36

Sharing

Report Analysis Logs

General

Target

d3d9.dll
Size

52KB
MD5

a0b39a6702b9211efb109826c22d2bb4
SHA1

bfba718bfe0cf8b66b7e7636115fa6bb7991676a
SHA256

add606aed192fefaf9b3932d4d650c5ecc5bbe4bce547c6e075ae8d7d7200a31
SHA512

d105cec2d960f1b46dd8e13a66df1443905f9a7f9cb1d634417192ac4f3237fd166807f0f11437a39b9ccb7d970af3874eb7d4566fc9330da57a26bcef35bfe3
SSDEEP

768:z9gkr+iy0BMPRIk4owU3JLaB19t+S0H/fVEJfvBxHFMDfh9L:Bgkr325I5zeq9IS0fy2Df7L

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 856	1796	rundll32.exe	28
PID 1796 wrote to memory of 856	1796	rundll32.exe	28
PID 1796 wrote to memory of 856	1796	rundll32.exe	28
PID 1796 wrote to memory of 856	1796	rundll32.exe	28
PID 1796 wrote to memory of 856	1796	rundll32.exe	28
PID 1796 wrote to memory of 856	1796	rundll32.exe	28
PID 1796 wrote to memory of 856	1796	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3d9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3d9.dll,#1
  2⤵
  PID:856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads