8244d3c049d38b92198166cd4f16d6a77f67c731fd157683c25decf4e699867e | Triage

Analysis

max time kernel
142s
max time network
276s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
16-04-2024 19:36

Sharing

Report Analysis Logs

General

Target

d3dcompiler_47.dll
Size

4.0MB
MD5

d9712d33f13c76382d169ace4412950c
SHA1

aa9a70a2504652c74c954a19bddf9abbe5ed846e
SHA256

bf35aa54602bfacaf119a1f461f38318b6317560bd2922bbb70552b1859b0a5f
SHA512

01672dcddf65d3f98e6fad5368485ea804e14b94836ef52b238614865d14083ecba8cf5417afee8eea95d569092c552649d60974a8d645147304c406f713edb2
SSDEEP

98304:t4Xyn7IfxiYMzgom1mEU/AJC/vujMD9CUa:H09om1hU/Aavu4D9CUa

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2060	2368	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 2368	3232	rundll32.exe	81
PID 3232 wrote to memory of 2368	3232	rundll32.exe	81
PID 3232 wrote to memory of 2368	3232	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1
  2⤵
  PID:2368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 468
    3⤵
    - Program crash
    PID:2060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2368 -ip 2368
1⤵
PID:3632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads