6108fe6c491d95e6869c3605197c261d341159ae4a565ca8613184aae5020b74

Analysis

max time kernel
39s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-09-2022 23:42

Target

RAVAntivirus/ui/d3dcompiler_47.dll
Size

4.7MB
MD5

b8194cbd6159753536ebb1e0d23e9ac2
SHA1

dc8ae041a90a463a56f895461bbb905193a68890
SHA256

5bc1dc6d3f9408838e75de03cb0a26b1e0689acd39aa59c94d9a167dd74e8667
SHA512

25a3ff999f699a934087ca98415fe05ac1f40b688179faab3855c3debb017f5124d43a5f0b5a14f9b9049c434bff4e9bdc472574ebdd2a4523f0ca83fbd3301c
SSDEEP

49152:buhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8ccs:Ty904wYbZCoOI85oyI/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
240	276	WerFault.exe	18

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 276 wrote to memory of 240	276	rundll32.exe	28
PID 276 wrote to memory of 240	276	rundll32.exe	28
PID 276 wrote to memory of 240	276	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RAVAntivirus\ui\d3dcompiler_47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:276
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 276 -s 92
  2⤵
  - Program crash
  PID:240