5e9ce91eea4b67d7c7d4326c7a5784191c7bfdfc29d434236515d6b9c684e8bb

Analysis

max time kernel
26s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
07/03/2023, 21:55

Target
required documents-85515212/vk_swiftshader.dll
Size 4.8MB
Sample230307-1s6pbabg21
SHA256 479f3a6dd641d18652b30f7e6971eadcd580b1428b9ce9a1878d5e6b057c3a98
MD5 80cab86c2f4419b674012c3756d088c2
SHA1 89a3a42aba421cb5f924c89a89734f952153bd7d
SHA512 1d0cca96db6e691f617b456754c02eda64a35eed2aa8566444c116969cdda16ecc84606b2d97210c964e198c62955a5f999fcc612eb282d131cf5c1bf1fa0e24
SSDEEP 49152:Af94LbaELx0yxWN1E1jAIHmNSfma2jX+fFMyngJH4vbU5Hyt4EJOhmCIWyruHYD0:i4LKhQabHUJ8mdW45AUqXcAUwBb
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1328	1400	WerFault.exe	15

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 1328	1400	rundll32.exe	28
PID 1400 wrote to memory of 1328	1400	rundll32.exe	28
PID 1400 wrote to memory of 1328	1400	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\required documents-85515212\vk_swiftshader.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1400 -s 84
  2⤵
  - Program crash
  PID:1328