a2d4c19d2a8c9a6a196ebcf1f49a6eed03b06b76880d772fa8c0ab72aec59763

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 20:48

Target

vk_swiftshader.dll
Size

4.5MB
MD5

11308456ed9d5a9ebfdbc0f86160e797
SHA1

a56a42951a4365b0228bdac44a31cca6b789a60e
SHA256

18436e3ffaa5ad29f0fa0daba05cfd99ad6ae2ccc7d6a5bff9d4decd97c0993e
SHA512

062389e03d4480f51c2ff9538f98f8d14b14017393295e5599bef10171c5dce6a3bb6318baf2f5d3f03ec016541f7b657d4ab4e78bfb40c9016a62ff0fe5ff76
SSDEEP

49152:bO6IzWGejMxLmo/FxJga4kIKvGtY48loR/ciu4skCDC88PF/VoQ28iasG+Stxf+P:S7/pEEkSUwsNE/d

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1956 wrote to memory of 1880	1956	rundll32.exe	28
PID 1956 wrote to memory of 1880	1956	rundll32.exe	28
PID 1956 wrote to memory of 1880	1956	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1956 -s 80
  2⤵
  PID:1880