Analysis

  • max time kernel
    139s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-05-2024 14:05

General

  • Target

    3dmgame.dll

  • Size

    185KB

  • MD5

    bcb677412655eb7d164bb4cf25736c8c

  • SHA1

    5e850613b26ff16dd35b67a855c343d5722abee0

  • SHA256

    e147c79621000e7c85e72ddadc2a7290693b8d5e7e147a7e3e48b3e0df5f1c6b

  • SHA512

    210178f9ec05bdf8e263794dc26a023a1cacfa7015c8245f39d16a5cdafee7612197c3e19718bcb0c0617f416167d26dc337aa5602c70f623ccd8187bbe26bb7

  • SSDEEP

    3072:mlQDbs1vdeouN9kMq6GwzbIN3FVyBRhs9uJz5ey0QFhnL+2JzeDqzMCmwoS:mmDbmen9kMlGwz0N3FVXuJzUGiiquBL

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\3dmgame.dll,#1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/900-3-0x00007FF9E58F0000-0x00007FF9E597D000-memory.dmp

    Filesize

    564KB

  • memory/900-0-0x00007FF9E58F0000-0x00007FF9E597D000-memory.dmp

    Filesize

    564KB

  • memory/900-4-0x00007FF972950000-0x00007FF972951000-memory.dmp

    Filesize

    4KB

  • memory/900-5-0x00007FF972940000-0x00007FF972941000-memory.dmp

    Filesize

    4KB