4969529f962c7cbbb1c368b92dd2f99131c3ad6e5a12919b8aee8b47c92beacf

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/03/2024, 11:50

Target
D3DCompiler_43.dll
Size 2.4MB
Sample240329-nzkdfagg89
SHA256 44c3a7e330b54a35a9efa015831392593aa02e7da1460be429d17c3644850e8a
MD5 ada0c39d4eacdc81fd84163a95d62079
SHA1 207321f1b449985b2d06ed50b989fa6259e4eb8e
SHA512 1afc63db5d2030b76abc19094fc9fef28cc6250bd265294647e65db81f13749c867722924460f7a6021c739f4057f95501f0322cdec28a2101bf94164557a1a5
SSDEEP 49152:zf59zPxKcvHzDB6t3+C0/aJfyLg7Ie4Xy+5j4m2CTB:M2642o7lftd
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 2780	1220	rundll32.exe	28
PID 1220 wrote to memory of 2780	1220	rundll32.exe	28
PID 1220 wrote to memory of 2780	1220	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\D3DCompiler_43.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1220 -s 84
  2⤵
  PID:2780