cdd9213c986f4dcc1f2c07f584d564c6a3ba00c9c27fe016bf51fd70ff0ef973

Analysis

max time kernel
298s
max time network
305s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 23:01

Target

d3dcompiler_47.dll
Size

3.5MB
MD5

9e490be9553d7de01682f5a2c2e8bec0
SHA1

1f557e13df328157b97b8cfa52808bbca965e395
SHA256

05e9e70ece4e810f163a22232b73d366f18dde3496bcef8fc556ec71c704ef72
SHA512

726fd19808376a46e99f14546dad2ed8ebfe0d39dcfefbb7022012436a169164c62393a455748e251e27e0f14fa945ffb27904fc4a9aa5b397e489c544fac65e
SSDEEP

49152:OjmJAksRXmBNgC9ITPPE8WHmy0HRZ+kyOzDJn5c5v5H3pqC23u6q+25omPEyXzj4:Oy2Ckrj+kyOv2MJ+6q8kbqS/A7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4960	1472	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 1472	4684	rundll32.exe	85
PID 4684 wrote to memory of 1472	4684	rundll32.exe	85
PID 4684 wrote to memory of 1472	4684	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll,#1
  2⤵
  PID:1472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 612
    3⤵
    - Program crash
    PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1472 -ip 1472
1⤵
PID:4204