1d152cb544822ef4e0facc7622d8726c812cd27b05d2483aa009ce6410ec5a7f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-06-2024 19:47

Target

D3DCompiler_47_cor3.dll
Size

3.9MB
MD5

d935c9f57aa56b90ae4da0a0bb280e0f
SHA1

d6364fb5e50ac93e37db5f49b85d28823ed89191
SHA256

f8c35b65524c60aa1765b13dc96a92a16d5570827b7fe6ccabfa9859d2a6ad60
SHA512

1bd535ecfe5611c2b43a9556efb41f0bff1ed64e480b069c30ab2fcf30c1a364542703fada877d91e626fd36e37b2fc4d8c053a2fca78a94d0b21ea66ea8b4c8
SSDEEP

49152:LS7iQ+besnXqRtHKzhwSsz6Ku1FVVOsLQuouM0MeADf6FqxLfeIgSNwLTzHiU2Iz:L4ihqqFVUsLQV6FqVCLTzHxJIPO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4912	636	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 636	1496	rundll32.exe	80
PID 1496 wrote to memory of 636	1496	rundll32.exe	80
PID 1496 wrote to memory of 636	1496	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\D3DCompiler_47_cor3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\D3DCompiler_47_cor3.dll,#1
  2⤵
  PID:636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 612
    3⤵
    - Program crash
    PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 636 -ip 636
1⤵
PID:3692