184c0d536e94e802fbadccc66915ae865c98134fe968e3bbc3bdb49378b37dce

Analysis

max time kernel
14s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21-02-2023 07:48

Target

Software/Sourse/About/Sourse/cs/D3Dcompiler_47.dll
Size

3.3MB
MD5

3d754486995769183d176c167de4f18b
SHA1

08249b4110f28b7740e620975d7b0fe4a85a71b2
SHA256

0c31e116441d4da0f08ca4182ac4099d7a2e2fea746903cc92d116173de3f81d
SHA512

e4567dc43588a60efcc8ee0bdb86a0e69189a4630f6cc31ce5e35d7bd6dd4a9af67eee076ebac064b77d2e17ac29e82ccdee393bfd71eccc2a781a7acab51e39
SSDEEP

49152:dyZ9lnpmVm/w+EwVOmufvkQS8MH2J9CqS5Sqr88pPWW5KhQYPsXqUiQD:29fWAwVBC8MH2JNSF8+YPsXqUTD

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

996 1948 WerFault.exe rundll32.exe

pid	pid_target	process	target process
996	1948	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2032 wrote to memory of 1948	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 1948	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 1948	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 1948	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 1948	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 1948	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 1948	2032	rundll32.exe	rundll32.exe
PID 1948 wrote to memory of 996	1948	rundll32.exe	WerFault.exe
PID 1948 wrote to memory of 996	1948	rundll32.exe	WerFault.exe
PID 1948 wrote to memory of 996	1948	rundll32.exe	WerFault.exe
PID 1948 wrote to memory of 996	1948	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Software\Sourse\About\Sourse\cs\D3Dcompiler_47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Software\Sourse\About\Sourse\cs\D3Dcompiler_47.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 224
3⤵
- Program crash
PID:996