91a1276b535db4a5a4629b3d917057585e4749543b442725eb579d2b06fef8cf

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 02:10

Target

D3Dcompiler_47.dll
Size

4.0MB
MD5

b0ae3aa9dd1ebd60bdf51cb94834cd04
SHA1

ee2f5726ac140fb42d17aba033d678afaf8c39c1
SHA256

e994847e01a6f1e4cbdc5a864616ac262f67ee4f14db194984661a8d927ab7f4
SHA512

756ebf4fa49029d4343d1bdb86ea71b2d49e20ada6370fd7582515455635c73d37ad0dbdeef456a10ab353a12412ba827ca4d70080743c86c3b42fa0a3152aa3
SSDEEP

49152:8BfmqCtLI4erBYysLjG/A8McPyCD6hw16JVTW7B3EgvVlQ3LAYmyNOvGJse+aWyb:8eZevVKACOvWYQF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2176	3024	rundll32.exe	30
PID 3024 wrote to memory of 2176	3024	rundll32.exe	30
PID 3024 wrote to memory of 2176	3024	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\D3Dcompiler_47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3024 -s 88
  2⤵
  PID:2176