05451b195a176fa75fb7a8de600068e1f08b2a0b5cef42eef8439ec28ed26a59 | Triage

Resubmissions

27/04/2024, 19:36

240427-ybnfasfc9t 7

27/04/2024, 19:12

240427-xwpy7afb2v 7

27/04/2024, 18:20

240427-wy4ppaed6x 7

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 18:20

Sharing

Report Analysis Logs

General

Target

vk_swiftshader.dll
Size

5.1MB
MD5

524b0d85d992f86a7f26c162f3dbb91c
SHA1

bc9c862fd01f6134a0514dcb63f9fab7a61ce269
SHA256

5b2ffb78fa963f2dea5a7fcf7676fc3aba243c4372d7528c8f1fc8f726d0a3fa
SHA512

422a18af294d7551224e05f5f4f5dcfa51b3455c2e61fc285fd2b95b50274eb77ff317647e17b0e7d47459b4fed19c7c88c90e0878f2269a78d598b1196401d8
SSDEEP

98304:RKJSTu+985EkjstvgsnpkkHF3y/AFIB7:RQq85EkjstvgsnpkkJETB

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2916	2984	rundll32.exe	28
PID 2984 wrote to memory of 2916	2984	rundll32.exe	28
PID 2984 wrote to memory of 2916	2984	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2984 -s 80
  2⤵
  PID:2916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads