2e8edf52b2571991106e0e3108a9e4099cbbe4b700fae923f8d6b948ee13aaa9

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27-02-2024 19:00

Target

vk_swiftshader.dll
Size

5.0MB
MD5

d9a049f0cc7301bf6ec8a8745662c27f
SHA1

60f16bfa1ff1341c0ba15b6bcea2d6bac9535aab
SHA256

dd2e5b7b0c9782294dfc6e42932d6588a3e1cf17f7696405c3e19a18066ec546
SHA512

5ad3dfd8744126e2dcb4a6f15c331792e85aa4de5858081ef3ce8a8e8f3c722cd66ba846c1103ffef14ff8e462456e48aca0bc2ba97412e2530d38b1e53ee169
SSDEEP

49152:AO6ftECL3Zdon2+a/EgBqB1y91lxfAV7xWV9MzaNZ8m8Lg1d7RXmVEZvMUn0HjyI:ALftMUSogaEm5hZdIOlEbRaB3YIw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1284	2040	rundll32.exe	28
PID 2040 wrote to memory of 1284	2040	rundll32.exe	28
PID 2040 wrote to memory of 1284	2040	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2040 -s 80
  2⤵
  PID:1284