1dc4ecb493c5e6319426306929fe0e667c7c5de0326ef29893c7cbb54ee3a370

Analysis

max time kernel
117s
max time network
131s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-12-2024 18:05

Target

Method/Method/Tool/Xdg/D3Dcompiler_47.dll
Size

4.0MB
MD5

b0ae3aa9dd1ebd60bdf51cb94834cd04
SHA1

ee2f5726ac140fb42d17aba033d678afaf8c39c1
SHA256

e994847e01a6f1e4cbdc5a864616ac262f67ee4f14db194984661a8d927ab7f4
SHA512

756ebf4fa49029d4343d1bdb86ea71b2d49e20ada6370fd7582515455635c73d37ad0dbdeef456a10ab353a12412ba827ca4d70080743c86c3b42fa0a3152aa3
SSDEEP

49152:8BfmqCtLI4erBYysLjG/A8McPyCD6hw16JVTW7B3EgvVlQ3LAYmyNOvGJse+aWyb:8eZevVKACOvWYQF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2600	2872	rundll32.exe	30
PID 2872 wrote to memory of 2600	2872	rundll32.exe	30
PID 2872 wrote to memory of 2600	2872	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Method\Method\Tool\Xdg\D3Dcompiler_47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2872 -s 88
  2⤵
  PID:2600