a3228a072409a8a3e96d305b669630bb03e0507bfe5472b7538237432ec8cfb8

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-03-2024 02:45

Target

vk_swiftshader.dll
Size

5.0MB
MD5

d9a049f0cc7301bf6ec8a8745662c27f
SHA1

60f16bfa1ff1341c0ba15b6bcea2d6bac9535aab
SHA256

dd2e5b7b0c9782294dfc6e42932d6588a3e1cf17f7696405c3e19a18066ec546
SHA512

5ad3dfd8744126e2dcb4a6f15c331792e85aa4de5858081ef3ce8a8e8f3c722cd66ba846c1103ffef14ff8e462456e48aca0bc2ba97412e2530d38b1e53ee169
SSDEEP

49152:AO6ftECL3Zdon2+a/EgBqB1y91lxfAV7xWV9MzaNZ8m8Lg1d7RXmVEZvMUn0HjyI:ALftMUSogaEm5hZdIOlEbRaB3YIw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2952	2872	rundll32.exe	28
PID 2872 wrote to memory of 2952	2872	rundll32.exe	28
PID 2872 wrote to memory of 2952	2872	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2872 -s 80
  2⤵
  PID:2952