4969529f962c7cbbb1c368b92dd2f99131c3ad6e5a12919b8aee8b47c92beacf | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/03/2024, 11:50

Sharing

Report Analysis Logs

General

Target

D3DCompiler_43.dll
Size

2.4MB
MD5

ada0c39d4eacdc81fd84163a95d62079
SHA1

207321f1b449985b2d06ed50b989fa6259e4eb8e
SHA256

44c3a7e330b54a35a9efa015831392593aa02e7da1460be429d17c3644850e8a
SHA512

1afc63db5d2030b76abc19094fc9fef28cc6250bd265294647e65db81f13749c867722924460f7a6021c739f4057f95501f0322cdec28a2101bf94164557a1a5
SSDEEP

49152:zf59zPxKcvHzDB6t3+C0/aJfyLg7Ie4Xy+5j4m2CTB:M2642o7lftd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 2780	1220	rundll32.exe	28
PID 1220 wrote to memory of 2780	1220	rundll32.exe	28
PID 1220 wrote to memory of 2780	1220	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\D3DCompiler_43.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1220 -s 84
  2⤵
  PID:2780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads