540b734c0f28db97285e938c115da9c2ff0dc097dadabcb89ae55e875557d8e7

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 20:22

Target

SMEditor/vk_swiftshader.dll
Size

4.3MB
MD5

5a3011f59ad6aceda78a8f42ba7cfa1e
SHA1

ce61a5acaafbf7464d9a26db762f9f661e6e9aac
SHA256

39612549c82c10b8a8e8072f2faf17354d8cccd3eeba1d5fda9c50ff547ffe5d
SHA512

16e9cbba44fb14e0e27fc872de51e501dffe79cc39b3386bcec28f6db874cb84606848e5c1e67322486fe29960dbd514fbf505af8c94cccd54126ab873a33aa7
SSDEEP

49152:KU82lTQcFMkjVGWalGA0GmK3jrmz5xbQ87uhvMxqyF2k2gwUIukCN/ET8CPhmQJF:u+TJXIfw05PhLJVS0Dy

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2964	2948	rundll32.exe	28
PID 2948 wrote to memory of 2964	2948	rundll32.exe	28
PID 2948 wrote to memory of 2964	2948	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SMEditor\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2948 -s 80
  2⤵
  PID:2964