b80f22e99442d50f5f294a9871711bb5c5adfa4346526df36cca2c98d2f860cb | Triage

Analysis

max time kernel
92s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 06:29

Sharing

Report Analysis Logs

General

Target

d3d9.dll
Size

2.1MB
MD5

e85ca73d8e9d39702ceca5ab14c19cbb
SHA1

6e1eec3457e7e9a8ca583910dbf61dc50feb17e7
SHA256

23700fb4d98ab79644aedc7d4ef01647d07c296e6c9ef09910ceaa372fd143c6
SHA512

03fd428319b0c1a5f8773b64da16633f8eace1a98f7ffc566868cf2d961ed8ddb73eea3258789d31998077663ab853d09bf9ce0a752bc74f0f73d094e6d50552
SSDEEP

24576:zBkSOSbyma1lm7dUn25vuz26ScQXePslpN99pqRBVMNRNjd:FkSOSbJcUh5WjQXTL9SGNjd

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3980	3236	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 3236	4708	regsvr32.exe	82
PID 4708 wrote to memory of 3236	4708	regsvr32.exe	82
PID 4708 wrote to memory of 3236	4708	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d3d9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d3d9.dll
  2⤵
  PID:3236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 732
    3⤵
    - Program crash
    PID:3980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3236 -ip 3236
1⤵
PID:5052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads