09b59f87c4407d78de16c329012b5aaa1cd5ccae2fd26f0ccebdebb7c231ec22

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 02:54

Target

d3dcompiler_47.dll
Size

4.7MB
MD5

2191e768cc2e19009dad20dc999135a3
SHA1

f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA256

7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
SHA512

5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
SSDEEP

49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 3048	2944	rundll32.exe	15
PID 2944 wrote to memory of 3048	2944	rundll32.exe	15
PID 2944 wrote to memory of 3048	2944	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2944 -s 88
  2⤵
  PID:3048