2854e234da3cf8855095e1b74f3bb61e5a39ebd534b531f46d875add3eb29312

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 23:07

Target

d3dcompiler_47.dll
Size

4.3MB
MD5

7641e39b7da4077084d2afe7c31032e0
SHA1

2256644f69435ff2fee76deb04d918083960d1eb
SHA256

44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
SHA512

8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
SSDEEP

49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2864	2808	rundll32.exe	29
PID 2808 wrote to memory of 2864	2808	rundll32.exe	29
PID 2808 wrote to memory of 2864	2808	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2808 -s 92
  2⤵
  PID:2864