4d4c6e971e2c8635ffdcc310998c0ab3b72595cc6589754666554da4128c4862

Analysis

max time kernel
135s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09-02-2024 09:00

Target

Akebi/dll/d3dsystem.dll
Size

3.5MB
MD5

d2d0ff97605d2c2f8921e93062eb01ff
SHA1

586cdca915f47fa4b1010f781ec0504e3138efd2
SHA256

4056e0804a13d791362555636ba34158fade7c1e71599e415a285de1472d83d5
SHA512

7bff38be4c5c41a978b33b9458dc885c59e68fa3dd4e56c6b980d334837bef37b2205b1b69aa1f058c0d8e24e3938c29da917a198b640b521d9726a505683b10
SSDEEP

49152:KrqFNHA0sqBRTFXIgeElWEmsZbcjTmV8h6rc15K5mppbIar24SP1sEZgTK3iU7Ed:KrwNvDLICV8suT724SFSmsJ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3452 2920 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3452	2920	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2072 wrote to memory of 2920	2072	rundll32.exe	rundll32.exe
PID 2072 wrote to memory of 2920	2072	rundll32.exe	rundll32.exe
PID 2072 wrote to memory of 2920	2072	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Akebi\dll\d3dsystem.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Akebi\dll\d3dsystem.dll,#1
2⤵
PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 612
3⤵
- Program crash
PID:3452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2920 -ip 2920
1⤵
PID:1396