50623f865bedcea99301e5b33e3c4bedf43e975e6297d5e4291009ef3ecafc35

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 01:55

Target

resources/bin/zenshot/D3Dcompiler_47.dll
Size

3.3MB
MD5

5dcc1b349ba79639022fad009ea6613d
SHA1

44b358a1bb912592a0e5832ec2df4154ab7550f7
SHA256

1248c8c8c98bbd8433a21892b15fdf17224a7f5e202b98277ea4390020602d66
SHA512

2a2c0704b7db6422e0726b07b4fcb1a381be745d921fd96349eb878e611a99dec51680bc2ac1faf675bc7f72714f129194db0977537d52d1135567be1c20c777
SSDEEP

49152:myZ9lnpmVm/w+EwVOmufvkQS8MH2J9CqS5Sqr88pPWW5KhQYPsXqUiQ3:z9fWAwVBC8MH2JNSF8+YPsXqUT3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2200	552	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 552	1196	rundll32.exe	28
PID 1196 wrote to memory of 552	1196	rundll32.exe	28
PID 1196 wrote to memory of 552	1196	rundll32.exe	28
PID 1196 wrote to memory of 552	1196	rundll32.exe	28
PID 1196 wrote to memory of 552	1196	rundll32.exe	28
PID 1196 wrote to memory of 552	1196	rundll32.exe	28
PID 1196 wrote to memory of 552	1196	rundll32.exe	28
PID 552 wrote to memory of 2200	552	rundll32.exe	29
PID 552 wrote to memory of 2200	552	rundll32.exe	29
PID 552 wrote to memory of 2200	552	rundll32.exe	29
PID 552 wrote to memory of 2200	552	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\bin\zenshot\D3Dcompiler_47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\bin\zenshot\D3Dcompiler_47.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 220
    3⤵
    - Program crash
    PID:2200