9a3245e6d3af81f8f515fca1dee9dc5e3aad9c2d263825ce975e2f2d19aa44e4

Analysis

max time kernel
8s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
30-03-2023 03:06

Target

Smartphone.Tycoon MT/d3dcompiler_47.dll
Size

3.5MB
MD5

587a415cd5ac2069813adef5f7685021
SHA1

ca0e2fe1922b3cdc9e96e636a73e5c85a838e863
SHA256

2ad0d4987fc4624566b190e747c9d95038443956ed816abfd1e2d389b5ec0851
SHA512

0fa0e89ea1c1cb27ac7f621feb484438e378a8f5675eca7a91f24e0569174bd848d470d6b3e237fe6ab27ca1eb1ecc09b5f044e53a6d98bf908e77ac511183e2
SSDEEP

49152:zjmJAksRXmBNgC9ITPPE8WHmy0HRZ+kyOzDJn5c5v5H3pqC23u6q+25omPEyXzjS:zy2Ckrj+kyOv2MJ+6q8kbqS/AF

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1236 848 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1236	848	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 628 wrote to memory of 848	628	rundll32.exe	rundll32.exe
PID 628 wrote to memory of 848	628	rundll32.exe	rundll32.exe
PID 628 wrote to memory of 848	628	rundll32.exe	rundll32.exe
PID 628 wrote to memory of 848	628	rundll32.exe	rundll32.exe
PID 628 wrote to memory of 848	628	rundll32.exe	rundll32.exe
PID 628 wrote to memory of 848	628	rundll32.exe	rundll32.exe
PID 628 wrote to memory of 848	628	rundll32.exe	rundll32.exe
PID 848 wrote to memory of 1236	848	rundll32.exe	WerFault.exe
PID 848 wrote to memory of 1236	848	rundll32.exe	WerFault.exe
PID 848 wrote to memory of 1236	848	rundll32.exe	WerFault.exe
PID 848 wrote to memory of 1236	848	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Smartphone.Tycoon MT\d3dcompiler_47.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:628

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Smartphone.Tycoon MT\d3dcompiler_47.dll",#1
2⤵
- Suspicious use of WriteProcessMemory
PID:848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 224
3⤵
- Program crash
PID:1236