56b2ad26e590842ced4ee1d987694c8fc4f7f556fbca6fad90dbe39ff71b5260

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
21/07/2023, 06:54

Target

Act I - Veda/d3dcompiler_47.dll
Size

4.1MB
MD5

222d020bd33c90170a8296adc1b7036a
SHA1

612e6f443d927330b9b8ac13cc4a2a6b959cee48
SHA256

4432bbd1a390874f3f0a503d45cc48d346abc3a8c0213c289f4b615bf0ee84f3
SHA512

ad8c7ce7f6f353da5e2cf816e1a69f1ec14011612e8041e4f9bb6ebed3e0fa4e4ebc069155a0c66e23811467012c201893b9b3b7a947d089ce2c749d5e8910c6
SSDEEP

49152:D5EfJYiVk9w6hAPqzag2At6i5K/8Ub6Lg3MEq/NHiQTtVr+5kb62QgdD6zoodr7P:l7iNPWHYE+Bnm8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2516	2408	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2516	2408	rundll32.exe	28
PID 2408 wrote to memory of 2516	2408	rundll32.exe	28
PID 2408 wrote to memory of 2516	2408	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Act I - Veda\d3dcompiler_47.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2408 -s 92
  2⤵
  - Program crash
  PID:2516