8398f9158dd22bfb3d847b38495a2720a73d83df4dc8c332837c97282cf56b98

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/03/2024, 16:42

Target

d3d.dll
Size

47KB
MD5

d48aabdc64a6e3463f4bed54d30e6a4b
SHA1

aef9bdee8fe77108d3da0eef5927295dcc90261f
SHA256

da963547705477773c34de9e91ea554bb44403989b03ea3fa4df8fd533fa868e
SHA512

44b01a42071d6fab3df42a7c9d0bcaa25989a10e9e030bca22b74cbd297e38bc2ea6ac93bf2e7a277fa107a2e1be3f4519a7ed7e0f92921de362d8b3ad4d2c17
SSDEEP

768:p3sqLhk7VX6TvZQj96mKj8dvlHYmpA8Sy+mpSBA39Zb2NNCNm980TAnIBEt2+qKB:GSk7ULZQj9vl4mpA8Sy+mpSBA39Zb2Nw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1664	2056	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2056	1676	rundll32.exe	28
PID 1676 wrote to memory of 2056	1676	rundll32.exe	28
PID 1676 wrote to memory of 2056	1676	rundll32.exe	28
PID 1676 wrote to memory of 2056	1676	rundll32.exe	28
PID 1676 wrote to memory of 2056	1676	rundll32.exe	28
PID 1676 wrote to memory of 2056	1676	rundll32.exe	28
PID 1676 wrote to memory of 2056	1676	rundll32.exe	28
PID 2056 wrote to memory of 1664	2056	rundll32.exe	29
PID 2056 wrote to memory of 1664	2056	rundll32.exe	29
PID 2056 wrote to memory of 1664	2056	rundll32.exe	29
PID 2056 wrote to memory of 1664	2056	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 244
    3⤵
    - Program crash
    PID:1664