d4990f7bcb35710c9a38dfb8c6cb324e43c47c72c6bb9c48d16d6b192fae4957 | Triage

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 11:58

Sharing

Report Analysis Logs

General

Target

vk_swiftshader.dll
Size

4.4MB
MD5

37bba2c66e2364a5b3e6666864f3b604
SHA1

f2ecffd48760482ba055aa50cd78c5ac02d09ba2
SHA256

23e6927733549be11d506b862cc7148b7b08b50b4387837db522ec9380babc46
SHA512

6e7835fce0e988c997049796125b4f2ef83cb9c2e326edeb54d4bad77fa31bf4b4227aeb1db445d3ee21e6cb959d65310a1bbda2d14e567d4123cf6544a947ea
SSDEEP

49152:vx2VjoakX4pb7QH1fUlTB7zmNmdpTE5NSomaZXYjLlHks2RPF/lOzl+LZ/n6du7F:A2DtJ+wixdag

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2000	2208	rundll32.exe	28
PID 2208 wrote to memory of 2000	2208	rundll32.exe	28
PID 2208 wrote to memory of 2000	2208	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2208 -s 80
  2⤵
  PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads