e8784b21f05c7f91ae6082ae912ddefddf62bccf717c2a9f649f147eb28eadbb

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 18:15

Target

vk_swiftshader.dll
Size

5.0MB
MD5

97f3eb7a38e6e9ec6757f320170d6171
SHA1

38f3165cb5243b38c33c34d88171f8a5f5668221
SHA256

79d822c157881b46c1136b14fd5164da9c528f0b1f2f0cc5ceed4b5fd4060c9f
SHA512

ca3d6dd07b848a045fc8976c058a01ce6ecf8ac0f2e121531435906ab66610fdd574fd1125dce4cc2a2f884000f32b54604a6b67f708c0feb14fff1291ab6996
SSDEEP

49152:OO6ftEjL3Zdon2+a/EgBqB1y91lxfAV7xWV9cO6NZ8m8xg1drRXmVEZvMUn0Hjyw:OLftlUSot6EmXxZdIOl5bzLB3dIWY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1096	2512	rundll32.exe	28
PID 2512 wrote to memory of 1096	2512	rundll32.exe	28
PID 2512 wrote to memory of 1096	2512	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2512 -s 80
  2⤵
  PID:1096