7635079472f751071c32a41949affd5f1e70a9f01c173f8e1ba0ae41302ea97e | Triage

Analysis

max time kernel
119s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 08:09

Sharing

Report Analysis Logs

General

Target

RJ01082861-PC/d3dcompiler_47.dll
Size

3.5MB
MD5

d808acb53436ca8bf04f88d3b40200cb
SHA1

493344c681a2269bb8c202f020ae0583814d2816
SHA256

381ec497d7d40b83616b0e82e15c597d04433acc20e94ebe5611f954b2e5309b
SHA512

86dc1ce2ae6c7a36b2f7d4a18278cec99a9a8743df657b2546ef46f0e8007c94d55354fe765a9c17a2fd5b15f21693691d177407b141be23bcde24635093efb5
SSDEEP

49152:1VBD1/zMxpjAeHhtiv2dGDwhMeX1/iK6AoVCdUTFE:17ZMxpjAeHhtivBDwh1c51

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2272	2920	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2920	2624	rundll32.exe	88
PID 2624 wrote to memory of 2920	2624	rundll32.exe	88
PID 2624 wrote to memory of 2920	2624	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RJ01082861-PC\d3dcompiler_47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\RJ01082861-PC\d3dcompiler_47.dll,#1
  2⤵
  PID:2920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 612
    3⤵
    - Program crash
    PID:2272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2920 -ip 2920
1⤵
PID:3736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads