cbd33d7ba3b8ef4562c696e1b70b5e71faded4cfb6b18b5f4c3d2eae20abf872

Analysis

max time kernel
133s
max time network
140s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
26-04-2024 14:21

Target

NetflixCE V4/NetflixCE/d3dhook.dll
Size

119KB
MD5

2a2ebe526ace7eea5d58e416783d9087
SHA1

5dabe0f7586f351addc8afc5585ee9f70c99e6c4
SHA256

e2a7df4c380667431f4443d5e5fc43964b76c8fcb9cf4c7db921c4140b225b42
SHA512

94ed0038068abddd108f880df23422e21f9808ce04a0d14299aacc5d573521f52626c0c2752b314cda976f64de52c4d5bcac0158b37d43afb9bc345f31fdbbc0
SSDEEP

1536:QyfNvGKKZVGcuasOKQBBTff07PSZHCSVKOCDCA32XQaOCKnOEPChMOE6:lNvG7vGcIiBTMS18RD7325YO/hMOr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4620	2712	WerFault.exe	73

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 2712	1448	rundll32.exe	73
PID 1448 wrote to memory of 2712	1448	rundll32.exe	73
PID 1448 wrote to memory of 2712	1448	rundll32.exe	73

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NetflixCE V4\NetflixCE\d3dhook.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\NetflixCE V4\NetflixCE\d3dhook.dll",#1
  2⤵
  PID:2712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 608
    3⤵
    - Program crash
    PID:4620