6e031a922ec21c373530a64d03151229faa39473a1044765f2a81f6c0589cbb4

Resubmissions

24-02-2024 15:39

24-02-2024 14:20

max time kernel
152s
max time network
174s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-02-2024 14:20

Target

vk_swiftshader.dll
Size

5.0MB
MD5

a0845e0774702da9550222ab1b4fded7
SHA1

65d5bd6c64090f0774fd0a4c9b215a868b48e19b
SHA256

6150a413ebe00f92f38737bdccf493d19921ef6329fcd48e53de9dbde4780810
SHA512

4be0cb1e3c942a1695bae7b45d21c5f70e407132ecc65efb5b085a50cdab3c33c26e90bd7c86198ec40fb2b18d026474b6c649776a3ca2ca5bff6f922de2319b
SSDEEP

49152:tG7ixZvPbWjIXTFy1RYQZHJvuZBiDTwgvsrt5/PXd0kpmaN+WUf4CvB25zT7RCAq:c7iDPqjvzO1Lhgf49zT7grg4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 3000	2808	rundll32.exe	28
PID 2808 wrote to memory of 3000	2808	rundll32.exe	28
PID 2808 wrote to memory of 3000	2808	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2808 -s 84
  2⤵
  PID:3000