6941f4998c8d31028e70cf62c5052999b1a15ee2d615f4eee31173d68cfa60b3 | Triage

Analysis

max time kernel
131s
max time network
141s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
01-07-2024 14:47

Sharing

Report Analysis Logs

General

Target

d3dx9_36.dll
Size

3.6MB
MD5

44bfec5c9c82a2ee9871d88fd3b9a0e2
SHA1

e2aeb78330d0815cffedfe88438a71024577d4b6
SHA256

c12f0ab0338eb5031d3d04beaf7208ac848f7e037d21ff963d2af90221cbe935
SHA512

35c42ce3afeeb3710d3d96d2cf9ffa2828fe17f8d749fd149e3797e87e154508c77f637de0e424d38bb3fa56bca959cf9da7787323950ec8261b144c09ae306d
SSDEEP

98304:7DNlnYF7Rej1ppSPBCfDOFjb613xfScl1lraX1gPYZaAHc6:7nCRexpaCfDOFjb613xfScl1dQgPY26

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2900 1808 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1004 wrote to memory of 1808	1004	rundll32.exe	rundll32.exe
PID 1004 wrote to memory of 1808	1004	rundll32.exe	rundll32.exe
PID 1004 wrote to memory of 1808	1004	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dx9_36.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1004

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dx9_36.dll,#1
2⤵
PID:1808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 616
3⤵
- Program crash
PID:2900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...