40a3d63256e959e889fe72e6d3c8ca44c3dceb06766dd8e0f6496594ab0ebed2 | Triage

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14-01-2024 23:59

Sharing

Report Analysis Logs

General

Target

vk_swiftshader.dll
Size

4.4MB
MD5

de2d91476e625278c30a5f69a1892e05
SHA1

4d707f6a801611fb437f5c1cba31b0909bf41506
SHA256

02c7f0b926c64f5a19a9aacd5f94ee00be4d576486592e18acc80c0a027b05ba
SHA512

d027407539346e5aedd527f5f71de45bace6295e96a7fbefbf273c930d64a791e488e4bdf6ef8db61fc19c80cac52a6e398c2973499c6fedb1e422c3ba71f532
SSDEEP

49152:px2VjoakX4pb7QH1fUlTB7zmNmdpTE5NSomaZXYjLlHks2RPF/lOzl+LZ/n6du7F:K2DtJ+wixdag

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2224	1960	rundll32.exe	14
PID 1960 wrote to memory of 2224	1960	rundll32.exe	14
PID 1960 wrote to memory of 2224	1960	rundll32.exe	14

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1960 -s 80
1⤵
PID:2224

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads