23a66b32dfa75a94036870a1dce0bfabe6b52331eb2bed02e6953b9fead97298

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 12:12

Target

D3DCompiler_47_cor3.dll
Size

3.9MB
MD5

d935c9f57aa56b90ae4da0a0bb280e0f
SHA1

d6364fb5e50ac93e37db5f49b85d28823ed89191
SHA256

f8c35b65524c60aa1765b13dc96a92a16d5570827b7fe6ccabfa9859d2a6ad60
SHA512

1bd535ecfe5611c2b43a9556efb41f0bff1ed64e480b069c30ab2fcf30c1a364542703fada877d91e626fd36e37b2fc4d8c053a2fca78a94d0b21ea66ea8b4c8
SSDEEP

49152:LS7iQ+besnXqRtHKzhwSsz6Ku1FVVOsLQuouM0MeADf6FqxLfeIgSNwLTzHiU2Iz:L4ihqqFVUsLQV6FqVCLTzHxJIPO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2244	4420	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 4420	3336	rundll32.exe	84
PID 3336 wrote to memory of 4420	3336	rundll32.exe	84
PID 3336 wrote to memory of 4420	3336	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\D3DCompiler_47_cor3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\D3DCompiler_47_cor3.dll,#1
  2⤵
  PID:4420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 612
    3⤵
    - Program crash
    PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4420 -ip 4420
1⤵
PID:4160