c291f69fe2c0a95a9949ac15d06182344d646cf591752e0db27e2a09c90a97e6

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 10:12

Target

NvFlexExtReleaseD3D_x64.dll
Size

426KB
MD5

5d424b62f3e889ee930b2367f9786025
SHA1

53094aa45472fc73447f9e48075568c2ac3e7822
SHA256

c448c3e976527cc7f36c04e55bbc10a25a11b0d8ee9e2c34cca53349009c4074
SHA512

c47c9bd1f0ee267abf16171f887a7705ff2c96fef9c428fab682175e785bfff203e206c22924ea5e0f627572d4b714a94fd90ce2caf985fec208ccbd97820800
SSDEEP

6144:Dfose2qHWGroimjMz4pMFvU/Tcda5M27hrNe3Ni7jrJRE+r2mKP9Bwx8fMzR+:DbK18SUYc7hcaLEa24U

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 1816	3068	rundll32.exe	30
PID 3068 wrote to memory of 1816	3068	rundll32.exe	30
PID 3068 wrote to memory of 1816	3068	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NvFlexExtReleaseD3D_x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3068 -s 80
  2⤵
  PID:1816