9a3245e6d3af81f8f515fca1dee9dc5e3aad9c2d263825ce975e2f2d19aa44e4

Analysis

max time kernel
76s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30-03-2023 03:06

Target

Smartphone.Tycoon MT/d3dcompiler_47.dll
Size

3.5MB
MD5

587a415cd5ac2069813adef5f7685021
SHA1

ca0e2fe1922b3cdc9e96e636a73e5c85a838e863
SHA256

2ad0d4987fc4624566b190e747c9d95038443956ed816abfd1e2d389b5ec0851
SHA512

0fa0e89ea1c1cb27ac7f621feb484438e378a8f5675eca7a91f24e0569174bd848d470d6b3e237fe6ab27ca1eb1ecc09b5f044e53a6d98bf908e77ac511183e2
SSDEEP

49152:zjmJAksRXmBNgC9ITPPE8WHmy0HRZ+kyOzDJn5c5v5H3pqC23u6q+25omPEyXzjS:zy2Ckrj+kyOv2MJ+6q8kbqS/AF

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2980 4420 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2980	4420	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3580 wrote to memory of 4420	3580	rundll32.exe	rundll32.exe
PID 3580 wrote to memory of 4420	3580	rundll32.exe	rundll32.exe
PID 3580 wrote to memory of 4420	3580	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Smartphone.Tycoon MT\d3dcompiler_47.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3580

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Smartphone.Tycoon MT\d3dcompiler_47.dll",#1
2⤵
PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 612
3⤵
- Program crash
PID:2980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4420 -ip 4420
1⤵
PID:1948