184c0d536e94e802fbadccc66915ae865c98134fe968e3bbc3bdb49378b37dce

Analysis

max time kernel
77s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21-02-2023 07:48

Target

Software/Sourse/About/Sourse/cs/D3Dcompiler_47.dll
Size

3.3MB
MD5

3d754486995769183d176c167de4f18b
SHA1

08249b4110f28b7740e620975d7b0fe4a85a71b2
SHA256

0c31e116441d4da0f08ca4182ac4099d7a2e2fea746903cc92d116173de3f81d
SHA512

e4567dc43588a60efcc8ee0bdb86a0e69189a4630f6cc31ce5e35d7bd6dd4a9af67eee076ebac064b77d2e17ac29e82ccdee393bfd71eccc2a781a7acab51e39
SSDEEP

49152:dyZ9lnpmVm/w+EwVOmufvkQS8MH2J9CqS5Sqr88pPWW5KhQYPsXqUiQD:29fWAwVBC8MH2JNSF8+YPsXqUTD

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1260 4980 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1260	4980	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4004 wrote to memory of 4980	4004	rundll32.exe	rundll32.exe
PID 4004 wrote to memory of 4980	4004	rundll32.exe	rundll32.exe
PID 4004 wrote to memory of 4980	4004	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Software\Sourse\About\Sourse\cs\D3Dcompiler_47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4004

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Software\Sourse\About\Sourse\cs\D3Dcompiler_47.dll,#1
2⤵
PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 612
3⤵
- Program crash
PID:1260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4980 -ip 4980
1⤵
PID:4276