96e6276b4d1ff728b1e2014a3be856a5e35a6a885df0797a54728868798feac2

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-01-2024 04:03

Target

DirectML.Debug.dll
Size

2.0MB
MD5

c24608f8d79552bd6ddc9284b544526d
SHA1

dd26c03c91e0348fbf341632ff55aab54cd60624
SHA256

0ba0f88285cd185172f3515ea19deed45c39a93d5feeb323c33e32c16e94ff75
SHA512

46f47a4b3aae8f09e869d452a50e80d695b463e43b22e6bb9a6e08f52ee282462d5c37393a4cc761c9ea3cfa83dfab83bf83d24c6b03e7f97b84cf042f96e685
SSDEEP

24576:rwMZdCDNHGkLnkMKIT/7lHw1hqyT4nARwLrPgt371OotECJsBb7hxsu9tg+rJAOY:rwDDNtr0+rJAbuyApN05SGXrp

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1728	1960	rundll32.exe	28
PID 1960 wrote to memory of 1728	1960	rundll32.exe	28
PID 1960 wrote to memory of 1728	1960	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DirectML.Debug.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1960 -s 80
  2⤵
  PID:1728