eb21a698101b0781187b0df85ea6683043e36d5e4229dc692b0a2e410c8adc6e

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 13:16

Target

vk_swiftshader.dll
Size

4.9MB
MD5

c055a29d48eded654fc91227af64dfa7
SHA1

2e9dde9c9d1f612dd4ff85d6b9415c2571e20741
SHA256

f34b0949439787926295b2a7c0f45b0c8176c1668d881fd0f9f1f579f9c58295
SHA512

6948c4236394b885ae5a059376d6b78aec039cf6574689d7d8fd0c0ec7965c12e63df19b8d0834e764ad06e8f48cc6f298f7262f3549ea50376f116c7a209767
SSDEEP

49152:u6PkZFjKeDTIEvAvlo6coVQxa8sVr0yN1J+MuXy557nDOPNt7wpr30sN+05uQKY1:uNZFjAgpOz2VeCCAkEvkCvGZv9z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2208	2364	rundll32.exe	28
PID 2364 wrote to memory of 2208	2364	rundll32.exe	28
PID 2364 wrote to memory of 2208	2364	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2364 -s 80
  2⤵
  PID:2208