37a59309b882e0987c434b292d33d4ac20ae34bc7a82f0e442624816abdab9ab | Triage

Analysis

max time kernel
216s
max time network
262s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2023, 18:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d3d10_1.dll
Size

206KB
MD5

01aef29fa3227a3cd717a341ff7fddd6
SHA1

ec59e69c0d466942a78e173f81ef73d7ae5a40b1
SHA256

37a59309b882e0987c434b292d33d4ac20ae34bc7a82f0e442624816abdab9ab
SHA512

ffcf00521a3d4f4a406ce1ffbf414163be9a5b4926cb303ab2201bba1c888f344a3f5515b07b3a7475524169774e88fc982286dbf265698f595c0ca050c8bf18
SSDEEP

3072:plBn7rb2AiW29yd/T+6s57+Q5VDOVO5XfK/:pbnXb2AihyZT+J57+Q5VDOVmK/

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1932	5076	WerFault.exe	78
4756	5076	WerFault.exe	78

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 1932	5076	rundll32.exe	81
PID 5076 wrote to memory of 1932	5076	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3d10_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 5076 -s 344
  2⤵
  - Program crash
  PID:1932
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 5076 -s 344
  2⤵
  - Program crash
  PID:4756

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 5076 -ip 5076
1⤵
PID:3140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5076-133-0x00007FF90B1A0000-0x00007FF90B1CF000-memory.dmp

Filesize
188KB

Download