aaf20e1523773d6a7f05297cb48c01b63ce2538ea47403191ff6cdc9f364b148

Analysis

max time kernel
1406s
max time network
1158s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
13-05-2024 17:31

Target

Synapse-X-Revamped-main/d3dcompiler_47.dll
Size

3.5MB
MD5

f76b1d2cd95385b21e61874761ddb53a
SHA1

e5219dc55dcd6b8643e3920ad21d0640fd714383
SHA256

8bf0eeb5081d8397e2f84f69449c8a80d9c0cdcf82bcef7a484309046adcb081
SHA512

8e5c6541bbea6730c4f6392439454f516d56ac9ad6d6b55336e52361cc80a35fbed8a90d58020d92fa4ac9fcfeee6c280754a9e99cc32bae901b00306626e69f
SSDEEP

49152:fjmJAksRXmBNgC9ITPPE8WHmy0HRZ+kyOzDJn5c5v5H3pqC23u6q+25omPEyXzjl:fy2Ckrj+kyOv2MJ+6q8kbqS/Ai

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1252 1656 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1252	1656	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3060 wrote to memory of 1656	3060	rundll32.exe	rundll32.exe
PID 3060 wrote to memory of 1656	3060	rundll32.exe	rundll32.exe
PID 3060 wrote to memory of 1656	3060	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Synapse-X-Revamped-main\d3dcompiler_47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3060

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Synapse-X-Revamped-main\d3dcompiler_47.dll,#1
2⤵
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 468
3⤵
- Program crash
PID:1252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1656 -ip 1656
1⤵
PID:3976