6a0664da0332aa8f4428914ba6aff37506fd239776a881e6d24f1cf5b60cbb70

Resubmissions

24-09-2023 15:33

max time kernel
118s
max time network
130s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
24-09-2023 15:33

Target

d3dcompiler_47.dll
Size

4.7MB
MD5

2191e768cc2e19009dad20dc999135a3
SHA1

f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA256

7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
SHA512

5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
SSDEEP

49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1200 wrote to memory of 2144	1200	rundll32.exe	WerFault.exe
PID 1200 wrote to memory of 2144	1200	rundll32.exe	WerFault.exe
PID 1200 wrote to memory of 2144	1200	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1200

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1200 -s 92
2⤵
PID:2144