fe6a7c0a2182b291b60041be502a9784554bd2264d48976f17dc5d4904f65ba3

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 15:30

Target

vk_swiftshader.dll
Size

4.9MB
MD5

50b9e79c8d4b88c3d8ff73339e168ada
SHA1

690bdc28d28a0e3fcf1c961fe9dfbcb580f9a2f6
SHA256

135d4f43b85fec0691df0150c924f4ca8c64b0ced0250da0ebc083704ef11f7c
SHA512

34ddffb63abf425dee5cd1eb2ff96e8ab7352886e473896923fbc0c7fafdb30432117e5622fa1cf0c71ac445f820ac0ae1a620b8a67752a881f9d3304efd242c
SSDEEP

49152:L6h3a0f1ABi1jP9LoS8lne0Zv8EgHI7JXYN3bgFNmEgMYmz2qA0Mr7wsVUsNCOzR:2h3aMXoSHfPwksHldLiuNr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 1312	1248	rundll32.exe	28
PID 1248 wrote to memory of 1312	1248	rundll32.exe	28
PID 1248 wrote to memory of 1312	1248	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1248 -s 80
  2⤵
  PID:1312