b56e537748f6b1c35ab9a4ef5e45191be683b0feb81114555dd9cc5f3ecfd532

Analysis

max time kernel
119s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-03-2024 21:43

Target

vk_swiftshader.dll
Size

5.1MB
MD5

a209cc01921c3cceebf40fd2ca3aa1eb
SHA1

7c6a483cd79642fc76ecd695f2bcbcd32034f11d
SHA256

d60bf3062d47378d169aea2f7e6666a099d116e55305ae4f3a494f969b7d3d4b
SHA512

276e8856ad362a6836c021f712df9668c1b0eaeb0ed4ba003b5aab5c37cb7427f6cbdcb51fbe657eeb3af276839a3f622a6499dc8b3a62cde82890eefca5e300
SSDEEP

49152:KL1wrvfRIQkXfBe1IlA8gE+LGHEYXb3GNfsUd9QjqZztkJCP1pSN6WxHEmp+DnnV:a1w7weOqiFIYBgTE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2216	1736	rundll32.exe	28
PID 1736 wrote to memory of 2216	1736	rundll32.exe	28
PID 1736 wrote to memory of 2216	1736	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1736 -s 84
  2⤵
  PID:2216