ba067698a42552e1f975d0c5c57ba51623c4db634ba7830a7a90bc4a219a48eb

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 19:14

Target

Debug/d3dcompiler_47.dll
Size

3.5MB
MD5

587a415cd5ac2069813adef5f7685021
SHA1

ca0e2fe1922b3cdc9e96e636a73e5c85a838e863
SHA256

2ad0d4987fc4624566b190e747c9d95038443956ed816abfd1e2d389b5ec0851
SHA512

0fa0e89ea1c1cb27ac7f621feb484438e378a8f5675eca7a91f24e0569174bd848d470d6b3e237fe6ab27ca1eb1ecc09b5f044e53a6d98bf908e77ac511183e2
SSDEEP

49152:zjmJAksRXmBNgC9ITPPE8WHmy0HRZ+kyOzDJn5c5v5H3pqC23u6q+25omPEyXzjS:zy2Ckrj+kyOv2MJ+6q8kbqS/AF

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3272 3488 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3272	3488	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3572 wrote to memory of 3488	3572	rundll32.exe	rundll32.exe
PID 3572 wrote to memory of 3488	3572	rundll32.exe	rundll32.exe
PID 3572 wrote to memory of 3488	3572	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Debug\d3dcompiler_47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Debug\d3dcompiler_47.dll,#1
  2⤵
  PID:3488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 612
    3⤵
    - Program crash
    PID:3272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3488 -ip 3488
1⤵
PID:4044