9e68542a9eebdb982433cdca5e3bf79246d85c03e85ccb82ea2886290b493184 | Triage

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 05:58

Sharing

Report Analysis Logs

General

Target

vk_swiftshader.dll
Size

4.4MB
MD5

37bba2c66e2364a5b3e6666864f3b604
SHA1

f2ecffd48760482ba055aa50cd78c5ac02d09ba2
SHA256

23e6927733549be11d506b862cc7148b7b08b50b4387837db522ec9380babc46
SHA512

6e7835fce0e988c997049796125b4f2ef83cb9c2e326edeb54d4bad77fa31bf4b4227aeb1db445d3ee21e6cb959d65310a1bbda2d14e567d4123cf6544a947ea
SSDEEP

49152:vx2VjoakX4pb7QH1fUlTB7zmNmdpTE5NSomaZXYjLlHks2RPF/lOzl+LZ/n6du7F:A2DtJ+wixdag

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 2748	1532	rundll32.exe	28
PID 1532 wrote to memory of 2748	1532	rundll32.exe	28
PID 1532 wrote to memory of 2748	1532	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1532 -s 84
  2⤵
  PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads