941c55c178d109c1af6ca548fbc8d5cf2abe6a7ae9c9517348f499e015ce14fc | Triage

Analysis

max time kernel
446s
max time network
456s
platform
windows11-21h2_x64
resource
win11-20231222-en
resource tags

arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system
submitted
06-02-2024 00:08

Sharing

Report Analysis Logs

General

Target

D3DDrv.dll
Size

773KB
MD5

c97d53a02c83b358c3cba5574afc35da
SHA1

b64ef4f112abb868b16186475fad22007f284596
SHA256

8638d7a9a6a104f96d223f56e2755607b6ddc471365584813e37d26e930297b1
SHA512

23c60f11ad3803b987c7728fad901f52255b9a7942e76619175d4e0bd1be7b60742a477cbdf303f3c125857bf82770f89bf74ef056d9075721968354a40c2c1d
SSDEEP

12288:wJ5J7MRKwCfMZvfQ10Jt/TBTOsRPYyH1fN47O1eT4JmHBNxnHQlMPXhWz+0nURJ:QS0Qlkq+0nURJ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3220 wrote to memory of 3620	3220	rundll32.exe	rundll32.exe
PID 3220 wrote to memory of 3620	3220	rundll32.exe	rundll32.exe
PID 3220 wrote to memory of 3620	3220	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\D3DDrv.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3220

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\D3DDrv.dll,#1
2⤵
PID:3620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...