c5f1dfbf8d4b1d8d5c43f668292056d5b670fea174e6e79d3cc2ba341d66a21f

Analysis

max time kernel
26s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
18-02-2023 03:32

Target

data/vk_swiftshader.dll
Size

4.7MB
MD5

65cff6700eba818c057c75287c7b14f2
SHA1

a1cc8ee2311b6065200808a1f6a509ce94b32a20
SHA256

00279690ad79083e3c1b292570035ea2e1e22cf377594a94210c4ff48828a65f
SHA512

2b4baa43e7cb7fff67977e402b19b9c39c8016c75fa86b001fc5aac3d8a1697e4ba5f0d3475c0869e04020f1e075f7803287659f947de7e0b6022aeb439c70b5
SSDEEP

49152:IaZyux4B2UFWiBJT3ZsDMJaoPKdGSQfb/fuoxvuDNkPHk+MHMnVATxfdB09f8XRL:Iu67gUknMVAa9f8RAo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
844	1404	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 844	1404	rundll32.exe	27
PID 1404 wrote to memory of 844	1404	rundll32.exe	27
PID 1404 wrote to memory of 844	1404	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1404 -s 84
  2⤵
  - Program crash
  PID:844