Analysis

  • max time kernel
    117s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    20-05-2024 14:05

General

  • Target

    3dmgame.dll

  • Size

    185KB

  • MD5

    bcb677412655eb7d164bb4cf25736c8c

  • SHA1

    5e850613b26ff16dd35b67a855c343d5722abee0

  • SHA256

    e147c79621000e7c85e72ddadc2a7290693b8d5e7e147a7e3e48b3e0df5f1c6b

  • SHA512

    210178f9ec05bdf8e263794dc26a023a1cacfa7015c8245f39d16a5cdafee7612197c3e19718bcb0c0617f416167d26dc337aa5602c70f623ccd8187bbe26bb7

  • SSDEEP

    3072:mlQDbs1vdeouN9kMq6GwzbIN3FVyBRhs9uJz5ey0QFhnL+2JzeDqzMCmwoS:mmDbmen9kMlGwz0N3FVXuJzUGiiquBL

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\3dmgame.dll,#1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:2972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2972-0-0x000007FEF7540000-0x000007FEF75CD000-memory.dmp

    Filesize

    564KB

  • memory/2972-3-0x000007FEF7540000-0x000007FEF75CD000-memory.dmp

    Filesize

    564KB

  • memory/2972-2-0x000007FEF74B0000-0x000007FEF753D000-memory.dmp

    Filesize

    564KB

  • memory/2972-1-0x000007FEF74B0000-0x000007FEF753D000-memory.dmp

    Filesize

    564KB

  • memory/2972-4-0x000007FEF74B0000-0x000007FEF753D000-memory.dmp

    Filesize

    564KB

  • memory/2972-7-0x000007FE7DB30000-0x000007FE7DB31000-memory.dmp

    Filesize

    4KB

  • memory/2972-8-0x000007FE7DB40000-0x000007FE7DB41000-memory.dmp

    Filesize

    4KB