7bb922f34437a2358f5eaa01d7f6c04dc2194e22e3e84f62ac8e5066defd2c38

Analysis

max time kernel
117s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-02-2024 02:58

Target

vk_swiftshader.dll
Size

4.9MB
MD5

6bbe7ed03b69b768ae56fe567527c895
SHA1

eef1850ef23c7183578e7c0fa215010e01a86186
SHA256

22075f53a28c922b0db3191117004b1c6e8a3c249861650bbf572661bbb9392f
SHA512

bb21900ef1e99a727981fcfe8b4c3d3b6b27b358fdcd0668b16dc0a630fbb49252eb909506bd0490ef91e0038a49eeb749966151b94edd60e5dcd015eb8359cd
SSDEEP

49152:Umk3591xY8JVUEpcxScQljT5HAeoDftT9n3G6KvgCvjZrexIVXXKFI8TTZUW31xl:Nk35ssGyPqhn2axtAm/u

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2152	1708	rundll32.exe	28
PID 1708 wrote to memory of 2152	1708	rundll32.exe	28
PID 1708 wrote to memory of 2152	1708	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1708 -s 84
  2⤵
  PID:2152