6941f4998c8d31028e70cf62c5052999b1a15ee2d615f4eee31173d68cfa60b3 | Triage

Analysis

max time kernel
133s
max time network
143s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
01-07-2024 14:47

Sharing

Report Analysis Logs

General

Target

d3dx9_40.dll
Size

4.2MB
MD5

eea5e428ce63804f9b12d21c97b5968f
SHA1

77a7f48f4bdb7e66ed5e524bb8879e3da0d6cd1d
SHA256

16fd909aeb68d0d1aca8529dc7f78880b97d6649d70ce8d03a2c858bc28e216b
SHA512

545518dabd82441ddfc17fe1c1cbd7d14603bb58130de1307a31f73b93ca42afdf25dfcf481f0383c4e039edfe4a88ae7b84b06a2850c29bbc3550114e499c73
SSDEEP

98304:E6EoQ715V9VRhAuR9ClDt2iHbEsX0sycGoKO0nceqyaWd2U:/Qp5VUuR9ClDt2iHbEsX0s6LO5Wd

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3164 864 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1908 wrote to memory of 864	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 864	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 864	1908	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dx9_40.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3dx9_40.dll,#1
2⤵
PID:864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 616
3⤵
- Program crash
PID:3164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...