ccc65cc16770cf1f444219f00680f9fe6234d543107e98413bb06c68aea92e86

Analysis

max time kernel
139s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09-02-2024 08:09

Target

Korepi/d3dcompiler_47.dll
Size

3.5MB
MD5

d2d0ff97605d2c2f8921e93062eb01ff
SHA1

586cdca915f47fa4b1010f781ec0504e3138efd2
SHA256

4056e0804a13d791362555636ba34158fade7c1e71599e415a285de1472d83d5
SHA512

7bff38be4c5c41a978b33b9458dc885c59e68fa3dd4e56c6b980d334837bef37b2205b1b69aa1f058c0d8e24e3938c29da917a198b640b521d9726a505683b10
SSDEEP

49152:KrqFNHA0sqBRTFXIgeElWEmsZbcjTmV8h6rc15K5mppbIar24SP1sEZgTK3iU7Ed:KrwNvDLICV8suT724SFSmsJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4972	3556	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 3556	2820	rundll32.exe	84
PID 2820 wrote to memory of 3556	2820	rundll32.exe	84
PID 2820 wrote to memory of 3556	2820	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Korepi\d3dcompiler_47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Korepi\d3dcompiler_47.dll,#1
  2⤵
  PID:3556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 612
    3⤵
    - Program crash
    PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3556 -ip 3556
1⤵
PID:2916