1c6df026b501c1bd0bd7538d1ad29c41565ee60a9441ae183f00d5409e0b48b4

Analysis

max time kernel
2s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
09-02-2024 08:52

Target

Minty/dll/d3dcompiler_47.dll
Size

3.5MB
MD5

d2d0ff97605d2c2f8921e93062eb01ff
SHA1

586cdca915f47fa4b1010f781ec0504e3138efd2
SHA256

4056e0804a13d791362555636ba34158fade7c1e71599e415a285de1472d83d5
SHA512

7bff38be4c5c41a978b33b9458dc885c59e68fa3dd4e56c6b980d334837bef37b2205b1b69aa1f058c0d8e24e3938c29da917a198b640b521d9726a505683b10
SSDEEP

49152:KrqFNHA0sqBRTFXIgeElWEmsZbcjTmV8h6rc15K5mppbIar24SP1sEZgTK3iU7Ed:KrwNvDLICV8suT724SFSmsJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4484	400	WerFault.exe	77

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 400	1020	rundll32.exe	77
PID 1020 wrote to memory of 400	1020	rundll32.exe	77
PID 1020 wrote to memory of 400	1020	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Minty\dll\d3dcompiler_47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Minty\dll\d3dcompiler_47.dll,#1
  2⤵
  PID:400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 468
    3⤵
    - Program crash
    PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 400 -ip 400
1⤵
PID:3468