435506cbe66bebdfdf9a2a94b1e8f483fdf108ab308129a6eb8dfd56a8bc77bc

Analysis

max time kernel
128s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2024 08:02

Target

$SYSDIR/Codecs/D3DCompiler_47.dll
Size

3.4MB
MD5

960ae99a15b1c8c9fbddde97606478f9
SHA1

0c856ba7367e719466adb73227c39dffeaddde27
SHA256

e3009e3738fab1f7cd685567c5aa1eb0a408ac51d0cda5da788841174d7625b1
SHA512

437e6e893a43529e181bd98ff7f16996a79012da02f15e1ded8ef4818383e98af6f5a8afccae351dd0f1c0a2e4f7a8a1f2ba43e2c5a9b29f9f6f5f58ab35ef87
SSDEEP

49152:1uVAMaMEjIHf+x7B/nb9ki5tFMvumXhQl3kPsXluxXb:oA42x75nuktGc3kPsXluxr

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

744 3240 WerFault.exe rundll32.exe

pid	pid_target	process	target process
744	3240	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2468 wrote to memory of 3240	2468	rundll32.exe	rundll32.exe
PID 2468 wrote to memory of 3240	2468	rundll32.exe	rundll32.exe
PID 2468 wrote to memory of 3240	2468	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Codecs\D3DCompiler_47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2468

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Codecs\D3DCompiler_47.dll,#1
2⤵
PID:3240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 612
3⤵
- Program crash
PID:744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 3240 -ip 3240
1⤵
PID:4816