f006540a62bc79c36f241ecb5b1c114e6933300e3d6b09e35e014660914bd845

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 14:14

Target

vk_swiftshader.dll
Size

4.3MB
MD5

df2f469b761a706fba0b50149660f7cf
SHA1

2f9d8cb92b6e321e24a5437a1f77745a3507e7be
SHA256

be1e1dd3897dc9a997fdc5b3216f9af24c20fc678963f7486b0a6dae8900c274
SHA512

827e979f573f5cbbe6dd3c6bbe4414ab0d292005856b651b157f150a8d5605c3e77f76944dc0158ae9c632bdc31c243b1e9a467f03d3d3ddb08e95ff5b2e1347
SSDEEP

49152:nR4+5d8q8C/l80az6722j5V7IqD0o/1aZ/MMN5xSvEftz4VbHX5C+cn4br4nhXsH:dDTvEF89HPoptTgY+XB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2744	1704	rundll32.exe	28
PID 1704 wrote to memory of 2744	1704	rundll32.exe	28
PID 1704 wrote to memory of 2744	1704	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1704 -s 80
  2⤵
  PID:2744