c52423a7641cb6c932fb45b9827685ab13c2028a783ad930b90560e42db5c1cd

Analysis

max time kernel
291s
max time network
296s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
01-03-2023 16:34

Target

SynapseCrack/bin/d3dcompiler_47.dll
Size

3.5MB
MD5

f76b1d2cd95385b21e61874761ddb53a
SHA1

e5219dc55dcd6b8643e3920ad21d0640fd714383
SHA256

8bf0eeb5081d8397e2f84f69449c8a80d9c0cdcf82bcef7a484309046adcb081
SHA512

8e5c6541bbea6730c4f6392439454f516d56ac9ad6d6b55336e52361cc80a35fbed8a90d58020d92fa4ac9fcfeee6c280754a9e99cc32bae901b00306626e69f
SSDEEP

49152:fjmJAksRXmBNgC9ITPPE8WHmy0HRZ+kyOzDJn5c5v5H3pqC23u6q+25omPEyXzjl:fy2Ckrj+kyOv2MJ+6q8kbqS/Ai

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1912 2068 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1912	2068	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2960 wrote to memory of 2068	2960	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 2068	2960	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 2068	2960	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SynapseCrack\bin\d3dcompiler_47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2960

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SynapseCrack\bin\d3dcompiler_47.dll,#1
2⤵
PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 612
3⤵
- Program crash
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2068 -ip 2068
1⤵
PID:2252