435506cbe66bebdfdf9a2a94b1e8f483fdf108ab308129a6eb8dfd56a8bc77bc

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-02-2024 08:02

Target

$SYSDIR/Codecs/D3DCompiler_47.dll
Size

3.4MB
MD5

960ae99a15b1c8c9fbddde97606478f9
SHA1

0c856ba7367e719466adb73227c39dffeaddde27
SHA256

e3009e3738fab1f7cd685567c5aa1eb0a408ac51d0cda5da788841174d7625b1
SHA512

437e6e893a43529e181bd98ff7f16996a79012da02f15e1ded8ef4818383e98af6f5a8afccae351dd0f1c0a2e4f7a8a1f2ba43e2c5a9b29f9f6f5f58ab35ef87
SSDEEP

49152:1uVAMaMEjIHf+x7B/nb9ki5tFMvumXhQl3kPsXluxXb:oA42x75nuktGc3kPsXluxr

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2732 2336 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2732	2336	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2688 wrote to memory of 2336	2688	rundll32.exe	rundll32.exe
PID 2688 wrote to memory of 2336	2688	rundll32.exe	rundll32.exe
PID 2688 wrote to memory of 2336	2688	rundll32.exe	rundll32.exe
PID 2688 wrote to memory of 2336	2688	rundll32.exe	rundll32.exe
PID 2688 wrote to memory of 2336	2688	rundll32.exe	rundll32.exe
PID 2688 wrote to memory of 2336	2688	rundll32.exe	rundll32.exe
PID 2688 wrote to memory of 2336	2688	rundll32.exe	rundll32.exe
PID 2336 wrote to memory of 2732	2336	rundll32.exe	WerFault.exe
PID 2336 wrote to memory of 2732	2336	rundll32.exe	WerFault.exe
PID 2336 wrote to memory of 2732	2336	rundll32.exe	WerFault.exe
PID 2336 wrote to memory of 2732	2336	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Codecs\D3DCompiler_47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2688

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Codecs\D3DCompiler_47.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 224
3⤵
- Program crash
PID:2732