b80f22e99442d50f5f294a9871711bb5c5adfa4346526df36cca2c98d2f860cb | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 06:29

Sharing

Report Analysis Logs

General

Target

d3d9.dll
Size

2.1MB
MD5

e85ca73d8e9d39702ceca5ab14c19cbb
SHA1

6e1eec3457e7e9a8ca583910dbf61dc50feb17e7
SHA256

23700fb4d98ab79644aedc7d4ef01647d07c296e6c9ef09910ceaa372fd143c6
SHA512

03fd428319b0c1a5f8773b64da16633f8eace1a98f7ffc566868cf2d961ed8ddb73eea3258789d31998077663ab853d09bf9ce0a752bc74f0f73d094e6d50552
SSDEEP

24576:zBkSOSbyma1lm7dUn25vuz26ScQXePslpN99pqRBVMNRNjd:FkSOSbJcUh5WjQXTL9SGNjd

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2708	2780	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2780	2768	regsvr32.exe	30
PID 2768 wrote to memory of 2780	2768	regsvr32.exe	30
PID 2768 wrote to memory of 2780	2768	regsvr32.exe	30
PID 2768 wrote to memory of 2780	2768	regsvr32.exe	30
PID 2768 wrote to memory of 2780	2768	regsvr32.exe	30
PID 2768 wrote to memory of 2780	2768	regsvr32.exe	30
PID 2768 wrote to memory of 2780	2768	regsvr32.exe	30
PID 2780 wrote to memory of 2708	2780	regsvr32.exe	31
PID 2780 wrote to memory of 2708	2780	regsvr32.exe	31
PID 2780 wrote to memory of 2708	2780	regsvr32.exe	31
PID 2780 wrote to memory of 2708	2780	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d3d9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d3d9.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 336
    3⤵
    - Program crash
    PID:2708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads