540b734c0f28db97285e938c115da9c2ff0dc097dadabcb89ae55e875557d8e7

Analysis

max time kernel
121s
max time network
132s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 20:22

Target

SMEditor/vulkan-1.dll
Size

892KB
MD5

2db0026c9329b1faf58971cf1ac51a6c
SHA1

e7e043ad9feb2086b4ead78a661c376de596e4d3
SHA256

e471e4e0a5635d2e5f6e1e5778016d0e5e169bc61aa32e5d380ebcd2502fc103
SHA512

ad1e66450ccbf49bbaf7632bb7b9c201d2bb0e53cf2594dacfda439545bb07aa2a085d188654e8e057d3ae0c1d682d3523942d9492d3c1f2d74bce8bf378d7e6
SSDEEP

24576:VkLGO/wBlPes+ERBTmqQRw6Z5WdDYsH26g3P0zAk7JeAy0:SLGQwBlOEDTVUw6Z5WdDYsH26g3P0zAC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2108	2192	rundll32.exe	28
PID 2192 wrote to memory of 2108	2192	rundll32.exe	28
PID 2192 wrote to memory of 2108	2192	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SMEditor\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2192 -s 100
  2⤵
  PID:2108