b89486615e9d50de29121851eb142207202c5aa9bc948ea0cfcad5016d5acc08

Resubmissions

28-06-2024 16:48

28-06-2024 16:39

max time kernel
420s
max time network
1176s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 16:39

Target

dgVoodoo_d3d9.dll
Size

439KB
MD5

63928ec29f6f85cca5b6884c85549061
SHA1

d0aef871968c47be06a0adfb922e733408156cf8
SHA256

d4c70d42d33e0dbfae4f766735a8d014f7e9a3583b67834d797fad6422877352
SHA512

d4740fe519c5edb084623445ecd5929e0765ba1ac02fecebf844f88051272eb7542617d9254b860584160d8504870aa707232830baf9dce107fb0faf8ecaa064
SSDEEP

6144:38gHDzbTg1c7cdXg1VShb/eAZszfC+RZLRR2dAEb0uua4R2z1+KsV1G8wbPs/O/d:3JvbTgG7EgmYA/mLR0CouaIw1+KK46y

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2020	1648	rundll32.exe	86
PID 1648 wrote to memory of 2020	1648	rundll32.exe	86
PID 1648 wrote to memory of 2020	1648	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dgVoodoo_d3d9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dgVoodoo_d3d9.dll,#1
  2⤵
  PID:2020

memory/2020-0-0x0000000075490000-0x000000007562D000-memory.dmp

Filesize
1.6MB

Download