8863f887505fb33aa29b652cb3f84999c63da172d917b96ea7958a869d508506

Resubmissions

23/03/2024, 20:50

23/03/2024, 01:09

22/03/2024, 21:56

22/03/2024, 02:58

max time kernel
120s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/03/2024, 02:58

Target
vk_swiftshader.dll
Size 5.1MB
Sample240322-dglhnsff49
SHA256 d60bf3062d47378d169aea2f7e6666a099d116e55305ae4f3a494f969b7d3d4b
MD5 a209cc01921c3cceebf40fd2ca3aa1eb
SHA1 7c6a483cd79642fc76ecd695f2bcbcd32034f11d
SHA512 276e8856ad362a6836c021f712df9668c1b0eaeb0ed4ba003b5aab5c37cb7427f6cbdcb51fbe657eeb3af276839a3f622a6499dc8b3a62cde82890eefca5e300
SSDEEP 49152:KL1wrvfRIQkXfBe1IlA8gE+LGHEYXb3GNfsUd9QjqZztkJCP1pSN6WxHEmp+DnnV:a1w7weOqiFIYBgTE
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2360	2864	rundll32.exe	28
PID 2864 wrote to memory of 2360	2864	rundll32.exe	28
PID 2864 wrote to memory of 2360	2864	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2864 -s 80
  2⤵
  PID:2360