359ac7b1e8531ed6ce9f9a8e8cd8932f7a4fca0fc149008d702e395208c98cec

Analysis

max time kernel
53s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 01:01

Target

d3dx9_43.dll
Size

1.9MB
MD5

f4444e3e28d0d8152d007033beb88b31
SHA1

f104052ea21454dd7fc5455ccb4a2ed6b607e67f
SHA256

e1300b529124c0463b9af3d2f976dacd329564c0edcd7291128e723b8b110214
SHA512

16f62e7daf9e49d879371f99ad8b22336d5324f8075a1afb836f43f106717ac12de9a07f2bb76864f1125833ab5f9b0e0a64f07f413b5acdb8229db88d8c3c42
SSDEEP

24576:X04U6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBI:Xu66l2u45BiNYFrz31Cv3D29kd6k1D

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2496 wrote to memory of 2308	2496	rundll32.exe	rundll32.exe
PID 2496 wrote to memory of 2308	2496	rundll32.exe	rundll32.exe
PID 2496 wrote to memory of 2308	2496	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dx9_43.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2496

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dx9_43.dll,#1
2⤵
PID:2308