8398f9158dd22bfb3d847b38495a2720a73d83df4dc8c332837c97282cf56b98 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/03/2024, 16:42

Sharing

Report Analysis Logs

General

Target

3dfx.dll
Size

24KB
MD5

7d8e2aea41478cacc162ebb8069d03f5
SHA1

1604980cfcb4a45a5eb0115be46b84e91a2b978d
SHA256

6ad048980ac75f60f5cde81a07f534cbed6fe39a062c7f8a302ca42142d70ea3
SHA512

8fd39fc461dc45905b4a98cd4ec6d425e591497b3dfc6277185d52b878525eeb28ff41a6c684bccffc9989864309cc9a702a35af34b1e70da8fe1850b71f2415
SSDEEP

384:MoXUQUcd87pgT0E0YTvISy4CJYEKBvEqe0shLZ2D:zXUQ1L/gSyoPBvEnh9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3dfx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3dfx.dll,#1
  2⤵
  PID:1260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads