8398f9158dd22bfb3d847b38495a2720a73d83df4dc8c332837c97282cf56b98

Analysis

max time kernel
92s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 16:42

Target

d3d.dll
Size

47KB
MD5

d48aabdc64a6e3463f4bed54d30e6a4b
SHA1

aef9bdee8fe77108d3da0eef5927295dcc90261f
SHA256

da963547705477773c34de9e91ea554bb44403989b03ea3fa4df8fd533fa868e
SHA512

44b01a42071d6fab3df42a7c9d0bcaa25989a10e9e030bca22b74cbd297e38bc2ea6ac93bf2e7a277fa107a2e1be3f4519a7ed7e0f92921de362d8b3ad4d2c17
SSDEEP

768:p3sqLhk7VX6TvZQj96mKj8dvlHYmpA8Sy+mpSBA39Zb2NNCNm980TAnIBEt2+qKB:GSk7ULZQj9vl4mpA8Sy+mpSBA39Zb2Nw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4224	2644	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2644	2004	rundll32.exe	86
PID 2004 wrote to memory of 2644	2004	rundll32.exe	86
PID 2004 wrote to memory of 2644	2004	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3d.dll,#1
  2⤵
  PID:2644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 616
    3⤵
    - Program crash
    PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2644 -ip 2644
1⤵
PID:3460