c5f1dfbf8d4b1d8d5c43f668292056d5b670fea174e6e79d3cc2ba341d66a21f

Analysis

max time kernel
12s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
18-02-2023 03:32

Target

data/d3dcompiler_47.dll
Size

4.7MB
MD5

cb9807f6cf55ad799e920b7e0f97df99
SHA1

bb76012ded5acd103adad49436612d073d159b29
SHA256

5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
SHA512

f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62
SSDEEP

49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1552	1796	WerFault.exe	12

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 1552	1796	rundll32.exe	28
PID 1796 wrote to memory of 1552	1796	rundll32.exe	28
PID 1796 wrote to memory of 1552	1796	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\d3dcompiler_47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1796 -s 92
  2⤵
  - Program crash
  PID:1552