add606aed192fefaf9b3932d4d650c5ecc5bbe4bce547c6e075ae8d7d7200a31 | Triage

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 21:36

Sharing

Report Analysis Logs

General

Target

d3d9.dll
Size

52KB
MD5

a0b39a6702b9211efb109826c22d2bb4
SHA1

bfba718bfe0cf8b66b7e7636115fa6bb7991676a
SHA256

add606aed192fefaf9b3932d4d650c5ecc5bbe4bce547c6e075ae8d7d7200a31
SHA512

d105cec2d960f1b46dd8e13a66df1443905f9a7f9cb1d634417192ac4f3237fd166807f0f11437a39b9ccb7d970af3874eb7d4566fc9330da57a26bcef35bfe3
SSDEEP

768:z9gkr+iy0BMPRIk4owU3JLaB19t+S0H/fVEJfvBxHFMDfh9L:Bgkr325I5zeq9IS0fy2Df7L

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 872	3544	rundll32.exe	85
PID 3544 wrote to memory of 872	3544	rundll32.exe	85
PID 3544 wrote to memory of 872	3544	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3d9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3d9.dll,#1
  2⤵
  PID:872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads