0577b7e8c6a4d394e8be1eff342905b2f2c08490835716bd44e8e5158a3d7149 | Triage

Analysis

max time kernel
122s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 21:10

Sharing

Report Analysis Logs

General

Target

vk_swiftshader.dll
Size

4.4MB
MD5

37bba2c66e2364a5b3e6666864f3b604
SHA1

f2ecffd48760482ba055aa50cd78c5ac02d09ba2
SHA256

23e6927733549be11d506b862cc7148b7b08b50b4387837db522ec9380babc46
SHA512

6e7835fce0e988c997049796125b4f2ef83cb9c2e326edeb54d4bad77fa31bf4b4227aeb1db445d3ee21e6cb959d65310a1bbda2d14e567d4123cf6544a947ea
SSDEEP

49152:vx2VjoakX4pb7QH1fUlTB7zmNmdpTE5NSomaZXYjLlHks2RPF/lOzl+LZ/n6du7F:A2DtJ+wixdag

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2692 wrote to memory of 2552	2692	rundll32.exe	29
PID 2692 wrote to memory of 2552	2692	rundll32.exe	29
PID 2692 wrote to memory of 2552	2692	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2692 -s 84
  2⤵
  PID:2552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads