60541e6a43661f0ee2e70c0a7cedb86d44a874e5376949db7a2e1f604fa5cdf1

Analysis

max time kernel
387s
max time network
1592s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
13/05/2023, 17:32

Target

ninjaripper1.7.1/x86/d3dx8d.dll
Size

677KB
MD5

06dcb937d1a7c534c9b745e7e9e62985
SHA1

265e38e54ffdde1363d7ce57ab39048960e5ea0a
SHA256

f6e4b6004ba3a6aa8d47f5d273e668123891da09dd3d907ce29d4aaae8ba984e
SHA512

56ecd076c0cf71fcb577e89cec3f7043a8d372e97efd23549114839d22a2488479623fa15868a97d8818170b151725720b666e822764eeccb0ceb0cdef4331cd
SSDEEP

12288:RAaluE+pH6ShnH5Ar1upSJPN74h7ZWyjhh2psN9bCoUy0d:RAaAE+pH6qnG74h0yjeogoo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1872	4204	WerFault.exe	66

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 4204	4300	rundll32.exe	66
PID 4300 wrote to memory of 4204	4300	rundll32.exe	66
PID 4300 wrote to memory of 4204	4300	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ninjaripper1.7.1\x86\d3dx8d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ninjaripper1.7.1\x86\d3dx8d.dll,#1
  2⤵
  PID:4204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 616
    3⤵
    - Program crash
    PID:1872