49d3da4a93495e17dc507de8e4e25cd5a038d199da49e34250f423b9fcfedca9 | Triage

Resubmissions

16/04/2024, 19:44

240416-yfyf3aag99 7

16/04/2024, 19:29

240416-x7jljscb21 7

Analysis

max time kernel
123s
max time network
142s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
16/04/2024, 19:44

Sharing

Report Analysis Logs

General

Target

vk_swiftshader.dll
Size

4.5MB
MD5

65a5705d95a0820740b3396851ff1751
SHA1

a692a80bafc41ba1b29ef19890f8465b3fb20dcb
SHA256

4c4b935cbb320033f504a89b1eb0a4bcb176bbd46a5981153cb1f54deb146a1c
SHA512

0c5df23b96eaf952c4a498ff6d854df2b62e7631b16c2855ed37ddbadffba3dd52e7450f2e06cf094bec2e0d70d14c87a652150766d90ec8662e03123df5942d
SSDEEP

98304:x2GmsucG1vUTM3SFhCrHglx7LQDCwchuW6ugI:cuuF4XhCGLQDCaI

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3816	512	WerFault.exe	71

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 512	668	rundll32.exe	71
PID 668 wrote to memory of 512	668	rundll32.exe	71
PID 668 wrote to memory of 512	668	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
  2⤵
  PID:512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 616
    3⤵
    - Program crash
    PID:3816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads