bd82856effa255354bfb254ff1f1b072a1f4a4fa9dfc2c6572eaeed846e6f366

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 11:07

Target

d3dx9_43.dll
Size

1.9MB
MD5

f4444e3e28d0d8152d007033beb88b31
SHA1

f104052ea21454dd7fc5455ccb4a2ed6b607e67f
SHA256

e1300b529124c0463b9af3d2f976dacd329564c0edcd7291128e723b8b110214
SHA512

16f62e7daf9e49d879371f99ad8b22336d5324f8075a1afb836f43f106717ac12de9a07f2bb76864f1125833ab5f9b0e0a64f07f413b5acdb8229db88d8c3c42
SSDEEP

24576:X04U6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBI:Xu66l2u45BiNYFrz31Cv3D29kd6k1D

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1368	1992	rundll32.exe	28
PID 1992 wrote to memory of 1368	1992	rundll32.exe	28
PID 1992 wrote to memory of 1368	1992	rundll32.exe	28
PID 1992 wrote to memory of 1368	1992	rundll32.exe	28
PID 1992 wrote to memory of 1368	1992	rundll32.exe	28
PID 1992 wrote to memory of 1368	1992	rundll32.exe	28
PID 1992 wrote to memory of 1368	1992	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dx9_43.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dx9_43.dll,#1
  2⤵
  PID:1368