e10e4e255af0ba3293aed0222096b70d627a0a8217f1d3d76c2d6813e3074144

Analysis

max time kernel
1558s
max time network
1562s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 01:23

Target

vk_swiftshader.dll
Size

5.0MB
MD5

c3910a9fed38daf90b54b78ba39d0d40
SHA1

6e702fdea3d2989aadab102a2da6d3005cc135d2
SHA256

4a9ca5adbfdb3fd2cee0be0cef83ad21bfd8239d8ea0f8ef9849b8cf879d2d02
SHA512

65b72e9a209ead1a43344731163f39a3d05952b219c8bcc720d1256cc8adfadf938055a322ea951bf1a40172e12809fd487937a20df0c67d0497f671e1626ba0
SSDEEP

49152:eG7ixZvPbWjIXTFy1RYQZHJvuZBiDTwgvsrt5/PXd0kpmaN+WUf4CvB25zT7RCAt:b7iDPqjvzO1Lhgf49zT7grg4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2952	2888	rundll32.exe	28
PID 2888 wrote to memory of 2952	2888	rundll32.exe	28
PID 2888 wrote to memory of 2952	2888	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2888 -s 80
  2⤵
  PID:2952