60541e6a43661f0ee2e70c0a7cedb86d44a874e5376949db7a2e1f604fa5cdf1

Analysis

max time kernel
403s
max time network
1608s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
13/05/2023, 17:32

Target

ninjaripper1.7.1/x86/d3dwrap.dll
Size

126KB
MD5

bcd2b978b5b6e054329918191f5e4f59
SHA1

2ccb4a14a5f57a8b7f017d35f05c3f508cd00e77
SHA256

2ef4a920ec0565e29e5cf4150a2262177b65197a369929ea530835939839b8f7
SHA512

bf8ced021515aa74c15c02f64a477be66b96d78ed93b04d7e8946ddfd96326abdaa0e5c9aed0690e1378ee29997c29265e05834ec7653104c3a0736fd4eef57a
SSDEEP

1536:nsXiYT+/q1hsXI4j4zF/vuS0nk8Ng394CgZccjns8jcdvk+TKP6sDy:nsyYFDs44WYfnk7vk+TKP6sO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2604	2012	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 20 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2012	2060	rundll32.exe	66
PID 2060 wrote to memory of 2012	2060	rundll32.exe	66
PID 2060 wrote to memory of 2012	2060	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ninjaripper1.7.1\x86\d3dwrap.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ninjaripper1.7.1\x86\d3dwrap.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 708
    3⤵
    - Program crash
    PID:2604

memory/2012-123-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download