aa9fea628399566aea6b47fae693e037e22fba51902b37d525880f10cf5ee50f

Analysis

max time kernel
121s
max time network
139s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
09/02/2025, 10:20

Target

tools/Xdg/D3Dcompiler_47.dll
Size

4.0MB
MD5

b0ae3aa9dd1ebd60bdf51cb94834cd04
SHA1

ee2f5726ac140fb42d17aba033d678afaf8c39c1
SHA256

e994847e01a6f1e4cbdc5a864616ac262f67ee4f14db194984661a8d927ab7f4
SHA512

756ebf4fa49029d4343d1bdb86ea71b2d49e20ada6370fd7582515455635c73d37ad0dbdeef456a10ab353a12412ba827ca4d70080743c86c3b42fa0a3152aa3
SSDEEP

49152:8BfmqCtLI4erBYysLjG/A8McPyCD6hw16JVTW7B3EgvVlQ3LAYmyNOvGJse+aWyb:8eZevVKACOvWYQF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2456	2768	rundll32.exe	30
PID 2768 wrote to memory of 2456	2768	rundll32.exe	30
PID 2768 wrote to memory of 2456	2768	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tools\Xdg\D3Dcompiler_47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2768 -s 92
  2⤵
  PID:2456