4691b5820190679e577d8c7a0967e3328e1448ac8292de87b603cd9afe200364

Analysis

max time kernel
129s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:28

Target

Spoofer/D3DCompiler_47_cor3.dll
Size

3.9MB
MD5

3b4647bcb9feb591c2c05d1a606ed988
SHA1

b42c59f96fb069fd49009dfd94550a7764e6c97c
SHA256

35773c397036b368c1e75d4e0d62c36d98139ebe74e42c1ff7be71c6b5a19fd7
SHA512

00cd443b36f53985212ac43b44f56c18bf70e25119bbf9c59d05e2358ff45254b957f1ec63fc70fb57b1726fd8f76ccfad8103c67454b817a4f183f9122e3f50
SSDEEP

49152:OS7PQ+besnXqRtHKzhwSsz6Ku1FVVOsLQuouM0MeAD36FqxLfeIgSNwLTzHiU2Ir:O4PhqqFVUsLQl6FqVCLTzHxJIMd

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1584 1572 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1584	1572	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1420 wrote to memory of 1572	1420	rundll32.exe	rundll32.exe
PID 1420 wrote to memory of 1572	1420	rundll32.exe	rundll32.exe
PID 1420 wrote to memory of 1572	1420	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Spoofer\D3DCompiler_47_cor3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Spoofer\D3DCompiler_47_cor3.dll,#1
2⤵
PID:1572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 612
3⤵
- Program crash
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1572 -ip 1572
1⤵
PID:4652