ac94101c9d78aded5c0ce3207fb99bb4cb7083ec635b6fe7ed26b9414930d7ae

Analysis

max time kernel
145s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2023, 21:58

Target

vk_swiftshader.dll
Size

3.9MB
MD5

7d7a186497d7649654db6bc104fda70d
SHA1

668721ae6e6ba401aa273beffb982d39e83f9f18
SHA256

841bb25c72cf4f165917a6c8fdd38f42b158f12abd52cbb7ed4f21b5d02ebd36
SHA512

dad8ac1c09348db69d6b54be96e2477738c91660b481d2accebe6dee622bd504769a7d154cd38b580be47268e4c33e69c0d43c96eb47ebcfb2dc6da81521f08f
SSDEEP

49152:yWzcL9x2ydlDTa7GmidqJfec1e6u9px5Uxb92ZpJyTlN9lp/5iY8E8oP7qG7rm75:KaK1GPm4gmZZrVSowgaB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 4000	3572	rundll32.exe	86
PID 3572 wrote to memory of 4000	3572	rundll32.exe	86
PID 3572 wrote to memory of 4000	3572	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
  2⤵
  PID:4000