ba0f13322211b52802b5876273575b36f7b5623008b5ce6eaa535788cb3087cd

Analysis

max time kernel
28s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15-03-2023 23:08

Target

ReasonLabs/Common/Client/v1.0.7/vk_swiftshader.dll
Size

4.6MB
MD5

eb17e22624bcf2488a15d69c8e3df1ee
SHA1

bceb962f5c7ce56805c40cbe198c7360697b01c0
SHA256

121c6dfabc1e761fd0fe6e60a7dba7c57667348ef40c2dfc3481977e74bbea31
SHA512

ff35e3ae7c2c8d22d6d85f1ae88d7b96e13f9d0ab47dc56c6b88e14e9af7e36404b6398315c0f62682931743e13d96a071279dbcd74cd13ea7a51b1171635ad4
SSDEEP

49152:uO6IzWGejMxLmo/FxJga4kIKvGtY48loR/ciu4skCDC88PF/VoQ28iasG+Stxf+a:57/pEEkSUwsNYFds

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

588 992 WerFault.exe rundll32.exe

pid	pid_target	process	target process
588	992	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 992 wrote to memory of 588	992	rundll32.exe	WerFault.exe
PID 992 wrote to memory of 588	992	rundll32.exe	WerFault.exe
PID 992 wrote to memory of 588	992	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ReasonLabs\Common\Client\v1.0.7\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:992

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 992 -s 84
2⤵
- Program crash
PID:588