f3dfbacb9f780941ad25c4e5cfe7bd87e5593b5e6a6f83b3ba81eeca14721914

Analysis

max time kernel
30s
max time network
33s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2023 11:28

Target

7FAR - ZModeler 3.1.2 (build 1123)/D3DCompiler_42.dll
Size

1.9MB
MD5

b33b21db610116262d906305ce65c354
SHA1

38eef8d8917351ee9bdff2cc4fbfaefaa16b8231
SHA256

6c976311406c23aa71018d274da0ecdef43b6e3a3b0b01e941a5e8e4e974386c
SHA512

7049726ccbba90d06b3a56e1dbde8196935d4681b5548248cd3e6a8e38183c268152ba2b07eb90823bbe327c02ec946c59abe3562b59e29d9bcff8fe90e0adcc
SSDEEP

24576:JvjFvnqUUI6tHi2E0HvSiMKR4lKNZtPUJplNNbvnnVb4T9zSAUtcLt/oW1XfY6RO:nvFD2E0H6iMFyFUJNNDnVbk9zRUtA/Nq

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
5084	1920	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 4192 wrote to memory of 1920	4192	rundll32.exe	84
PID 4192 wrote to memory of 1920	4192	rundll32.exe	84
PID 4192 wrote to memory of 1920	4192	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\7FAR - ZModeler 3.1.2 (build 1123)\D3DCompiler_42.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\7FAR - ZModeler 3.1.2 (build 1123)\D3DCompiler_42.dll",#1
  2⤵
  PID:1920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 600
    3⤵
    - Program crash
    PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1920 -ip 1920
1⤵
PID:2720