3ec8bc64f586979417849f0ff2dcd849f30eeece2bd106c1526960e26327d359

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06-09-2024 23:00

Target

FurMark_win64/gxc_x64.dll
Size

5.3MB
MD5

a48e8070d48a200ccd877f5325e47765
SHA1

c6dfaf2b2319e0077b18be2e797273c7da8a72ef
SHA256

d6c121e7d62217fde8a6678af1b7c985bed5447e91f971da59b140d2a8539cdc
SHA512

331619f46a622fcd91c73ebb74bbb5d08c1d80c2824d0af5badc41a62ddcf232ea47a8771ca04904adddfd29faffc6d2cb323ace45a70f5f653109c1771f9a20
SSDEEP

49152:qyTdRwknUVR8qTN3222uP/2bk3bgWCDZwXn77JypnoRuGjXRs8SxScrexDDdTDtO:bdRwknUVvN/EDOI0M+D+g8RvTtNPGQV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 3068	2416	rundll32.exe	30
PID 2416 wrote to memory of 3068	2416	rundll32.exe	30
PID 2416 wrote to memory of 3068	2416	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FurMark_win64\gxc_x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2416 -s 176
  2⤵
  PID:3068