55dd41e0614ba9b4406c926cc1fd970351d14d11552f3a85d522af46b0a49e46

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2024 17:38

Target

SynapseX revamaped V1.2/bin/d3dcompiler_47.dll
Size

3.5MB
MD5

f76b1d2cd95385b21e61874761ddb53a
SHA1

e5219dc55dcd6b8643e3920ad21d0640fd714383
SHA256

8bf0eeb5081d8397e2f84f69449c8a80d9c0cdcf82bcef7a484309046adcb081
SHA512

8e5c6541bbea6730c4f6392439454f516d56ac9ad6d6b55336e52361cc80a35fbed8a90d58020d92fa4ac9fcfeee6c280754a9e99cc32bae901b00306626e69f
SSDEEP

49152:fjmJAksRXmBNgC9ITPPE8WHmy0HRZ+kyOzDJn5c5v5H3pqC23u6q+25omPEyXzjl:fy2Ckrj+kyOv2MJ+6q8kbqS/Ai

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3460 5048 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3460	5048	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4204 wrote to memory of 5048	4204	rundll32.exe	rundll32.exe
PID 4204 wrote to memory of 5048	4204	rundll32.exe	rundll32.exe
PID 4204 wrote to memory of 5048	4204	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SynapseX revamaped V1.2\bin\d3dcompiler_47.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4204

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SynapseX revamaped V1.2\bin\d3dcompiler_47.dll",#1
2⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 612
3⤵
- Program crash
PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5048 -ip 5048
1⤵
PID:1036