6d67a6b7b72220845abe6f3b798f509528e43de3afa798dcf36047996cc4a27e

Analysis

max time kernel
20s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 12:19

Target
Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1/Yuka - Scattered Shards of the Yokai/d3dcompiler_47.dll
Size 3.5MB
Sample240511-phgfwsae99
SHA256 381ec497d7d40b83616b0e82e15c597d04433acc20e94ebe5611f954b2e5309b
MD5 d808acb53436ca8bf04f88d3b40200cb
SHA1 493344c681a2269bb8c202f020ae0583814d2816
SHA512 86dc1ce2ae6c7a36b2f7d4a18278cec99a9a8743df657b2546ef46f0e8007c94d55354fe765a9c17a2fd5b15f21693691d177407b141be23bcde24635093efb5
SSDEEP 49152:1VBD1/zMxpjAeHhtiv2dGDwhMeX1/iK6AoVCdUTFE:17ZMxpjAeHhtivBDwh1c51
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2164	3660	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 3660	4924	rundll32.exe	82
PID 4924 wrote to memory of 3660	4924	rundll32.exe	82
PID 4924 wrote to memory of 3660	4924	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai\d3dcompiler_47.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai\d3dcompiler_47.dll",#1
  2⤵
  PID:3660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 612
    3⤵
    - Program crash
    PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3660 -ip 3660
1⤵
PID:3760