d3ab2fd2c5734f1765082547095fbc23f6df2c38a2beb8694b19dac8ccc9008a

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 03:00

Target

d3dx9_30.dll
Size

1.6MB
MD5

51d39765872b0e59a45ad50439d379c8
SHA1

4adf09fc5af78a2f8442a5f5a022c52a0cc3cfcf
SHA256

0c0135d5aca281165bc8b1429272af838539cc693095ad8f35fcbc3a82fc6fe8
SHA512

b9230f6313151e34570e8a211c3c67a1ff33b513d505b51448bedf1ff3e3abd71f820673713145b7d8da756a7097d399dd06ef243d3cd893b8e048a6d406b6d6
SSDEEP

49152:MJhV8fvM03+sCVWNnywRktqiPlLVwwiOBaUYX8R:u20MW2yWmPlLVwwiOBme

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3044	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3044	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 3044	2988	rundll32.exe	30
PID 2988 wrote to memory of 3044	2988	rundll32.exe	30
PID 2988 wrote to memory of 3044	2988	rundll32.exe	30
PID 2988 wrote to memory of 3044	2988	rundll32.exe	30
PID 2988 wrote to memory of 3044	2988	rundll32.exe	30
PID 2988 wrote to memory of 3044	2988	rundll32.exe	30
PID 2988 wrote to memory of 3044	2988	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dx9_30.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dx9_30.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:3044

memory/3044-0-0x00000000022C0000-0x0000000002931000-memory.dmp

Filesize
6.4MB

Download
memory/3044-1-0x00000000022C0000-0x0000000002931000-memory.dmp

Filesize
6.4MB

Download
memory/3044-2-0x00000000022C0000-0x0000000002931000-memory.dmp

Filesize
6.4MB

Download
memory/3044-3-0x0000000002887000-0x0000000002931000-memory.dmp

Filesize
680KB

Download
memory/3044-4-0x00000000022C0000-0x0000000002931000-memory.dmp

Filesize
6.4MB

Download