37a59309b882e0987c434b292d33d4ac20ae34bc7a82f0e442624816abdab9ab | Triage

Analysis

max time kernel
218s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16/04/2023, 18:32

Sharing

Report Analysis Logs

General

Target

d3d10_1.dll
Size

206KB
MD5

01aef29fa3227a3cd717a341ff7fddd6
SHA1

ec59e69c0d466942a78e173f81ef73d7ae5a40b1
SHA256

37a59309b882e0987c434b292d33d4ac20ae34bc7a82f0e442624816abdab9ab
SHA512

ffcf00521a3d4f4a406ce1ffbf414163be9a5b4926cb303ab2201bba1c888f344a3f5515b07b3a7475524169774e88fc982286dbf265698f595c0ca050c8bf18
SSDEEP

3072:plBn7rb2AiW29yd/T+6s57+Q5VDOVO5XfK/:pbnXb2AihyZT+J57+Q5VDOVmK/

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1624	1404	WerFault.exe	21

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 1624	1404	rundll32.exe	28
PID 1404 wrote to memory of 1624	1404	rundll32.exe	28
PID 1404 wrote to memory of 1624	1404	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3d10_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1404 -s 96
  2⤵
  - Program crash
  PID:1624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1404-54-0x000007FEFB290000-0x000007FEFB2BF000-memory.dmp

Filesize
188KB

Download