088a9f665d0fdc9b2bb050ecd1524b1539010bbe1d9935f72343bb2bc5f98975

Resubmissions

28-04-2024 15:54

28-04-2024 14:49

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 14:49

Target

vk_swiftshader.dll
Size

4.9MB
MD5

e31749b045043630542af612b5bb7f13
SHA1

e3a5e1087c228f107fd091a760094aa8fdcd01e7
SHA256

2bf61db50d0226c079c7b6516f36e76b46d1ba35cbc483dd625d8c83bef70dcb
SHA512

8b53042146ebf46f7804d8922d128edbe381a2a748d9c608affe07f1c3d4ad1691bacdfb39fccf2ca73d10b2f0c58c220a765e8dbb5be9b2ae1413d3cb17f923
SSDEEP

49152:t6h3a0f1ABi1jP9LoS8lne0Zv8EgHI7JXYN3bgFNmEgMYmz2qA0Mr7wsVUsNCOzG:4h3aMXoSHfPwksHldLiuNr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2864 wrote to memory of 2360	2864	rundll32.exe	WerFault.exe
PID 2864 wrote to memory of 2360	2864	rundll32.exe	WerFault.exe
PID 2864 wrote to memory of 2360	2864	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2864

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2864 -s 80
2⤵
PID:2360