eadcf660e731fd3de0a5a8bee2f2337e7d78438f4e9293d2c90d5e63a2d9368e

Resubmissions

26-07-2024 08:19

07-05-2024 20:40

23-04-2024 21:09

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-04-2024 21:09

Target

vk_swiftshader.dll
Size

4.9MB
MD5

f47f162198eb9a87c9cdb957523be637
SHA1

10634fb95a514b1729a00a03cd7dc88b95d83f9f
SHA256

3bd00334be2469806d3f286eb4599d897cf0fba9cf3f3c2b65ad2d2041561159
SHA512

816132e0071ba56a297f7bab51a6a3b58be3a0b51e2f4c425ac5a8ef2adfb650c5886ba80e5690a3c338f4863eabb72bf9194b7003db245fe268c5e6c0792c62
SSDEEP

49152:56PkZFjKeDTIEvAvlo6coVQxa8sVr0yN1J+MuXy557nDOPNt7wpr30sN+05uQKYh:5NZFjAgpOz2VeCCAkEvkCvGZD9z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2884 wrote to memory of 2528	2884	rundll32.exe	WerFault.exe
PID 2884 wrote to memory of 2528	2884	rundll32.exe	WerFault.exe
PID 2884 wrote to memory of 2528	2884	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2884

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2884 -s 80
2⤵
PID:2528