ebfc2b62ea889cf96c4eb0b649672c6b713ad163fd5818c2f46a9b5726dd80fb

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 14:46

Target

客户端/20201108/D3DX81ab.dll
Size

673KB
MD5

4d27c761c43f1f4094005889efd968eb
SHA1

3900a153f894dda7a8b23984b20d87b3ae6b01ab
SHA256

7afd418750824969fd6d0c6db949456998f792c97d6a69669051e1c90a458a5b
SHA512

5a173e16fec3555da024555c3b8ca3c95667b6f6e2286c8ab83a63a70b614effe01c7332a9f518ceb9cc6754295bbfc3fffb93e7e6ca36050a4e3a38ac48dc2e
SSDEEP

12288:g905yeX+DrR+wK/7OQQFICi7hrevXUdqzA/hz29FoVIJoLyq06:g9kOPi/ajFICi7EMdqzAB+cAo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3276	400	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 400	3100	rundll32.exe	85
PID 3100 wrote to memory of 400	3100	rundll32.exe	85
PID 3100 wrote to memory of 400	3100	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\客户端\20201108\D3DX81ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\客户端\20201108\D3DX81ab.dll,#1
  2⤵
  PID:400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 616
    3⤵
    - Program crash
    PID:3276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 400 -ip 400
1⤵
PID:4196