05451b195a176fa75fb7a8de600068e1f08b2a0b5cef42eef8439ec28ed26a59

Resubmissions

27/04/2024, 19:36

27/04/2024, 19:12

27/04/2024, 19:05

27/04/2024, 18:20

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 18:20

Target
vk_swiftshader.dll
Size 5.1MB
Sample240427-wy4ppaed6x
SHA256 5b2ffb78fa963f2dea5a7fcf7676fc3aba243c4372d7528c8f1fc8f726d0a3fa
MD5 524b0d85d992f86a7f26c162f3dbb91c
SHA1 bc9c862fd01f6134a0514dcb63f9fab7a61ce269
SHA512 422a18af294d7551224e05f5f4f5dcfa51b3455c2e61fc285fd2b95b50274eb77ff317647e17b0e7d47459b4fed19c7c88c90e0878f2269a78d598b1196401d8
SSDEEP 98304:RKJSTu+985EkjstvgsnpkkHF3y/AFIB7:RQq85EkjstvgsnpkkJETB
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2916	2984	rundll32.exe	28
PID 2984 wrote to memory of 2916	2984	rundll32.exe	28
PID 2984 wrote to memory of 2916	2984	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2984 -s 80
  2⤵
  PID:2916