50623f865bedcea99301e5b33e3c4bedf43e975e6297d5e4291009ef3ecafc35

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 01:55

Target
resources/bin/zenshot/D3Dcompiler_47.dll
Size 3.3MB
Sample240420-cb79taed4y
SHA256 1248c8c8c98bbd8433a21892b15fdf17224a7f5e202b98277ea4390020602d66
MD5 5dcc1b349ba79639022fad009ea6613d
SHA1 44b358a1bb912592a0e5832ec2df4154ab7550f7
SHA512 2a2c0704b7db6422e0726b07b4fcb1a381be745d921fd96349eb878e611a99dec51680bc2ac1faf675bc7f72714f129194db0977537d52d1135567be1c20c777
SSDEEP 49152:myZ9lnpmVm/w+EwVOmufvkQS8MH2J9CqS5Sqr88pPWW5KhQYPsXqUiQ3:z9fWAwVBC8MH2JNSF8+YPsXqUT3
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3528	4136	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 4136	4128	rundll32.exe	86
PID 4128 wrote to memory of 4136	4128	rundll32.exe	86
PID 4128 wrote to memory of 4136	4128	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\bin\zenshot\D3Dcompiler_47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\bin\zenshot\D3Dcompiler_47.dll,#1
  2⤵
  PID:4136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 612
    3⤵
    - Program crash
    PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4136 -ip 4136
1⤵
PID:3800