6941f4998c8d31028e70cf62c5052999b1a15ee2d615f4eee31173d68cfa60b3 | Triage

Analysis

max time kernel
130s
max time network
142s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
01-07-2024 14:47

Sharing

Report Analysis Logs

General

Target

SlimDX.dll
Size

3.2MB
MD5

1129265c56cb12904532f31f713ea0fc
SHA1

bdfd856b802fa5093b01700957c3736784d7f3ab
SHA256

a64c8fc2cfb860f7fa76d42942ebfe576a0d401f26ade70b55f9f2f7008409e0
SHA512

fa8d0b31ac0aa99664e661d6eec6be7fcb7f6c747354980e26a6b86b69c4d8082223c4a1c313ff1e9de3c8ad68d32b4bc72e2e93f4af1c74038eef0ff42b2a79
SSDEEP

49152:da5AiH6nw9P3rTfgCNfUMQCH8YgWXHeg/SJKFQx2rW6VZcmjTpHVTAlSXw5gELx/:zIrL/e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2216 wrote to memory of 4840	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 4840	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 4840	2216	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SlimDX.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2216

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SlimDX.dll,#1
2⤵
PID:4840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...