f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 23:38

Target
vk_swiftshader.dll
Size 5.1MB
Sample240510-3m8b3abc36
SHA256 0749491928a69673f17d39eb674f9a416e789e4fddec48ebb54714914343b48a
MD5 3eb74d173ef00f7c510b11e61c5ab52f
SHA1 13cfe224f966145d7f90640b080bef5dd4d0ff42
SHA512 423ab3765aa01cf39fa31d068ddb761ad93707cb06f57b4e674311c91c5cc9d238c231d1e6882f8d3525d16fea0d8f8db8d0a74bb55309f5a120cbe4a34e40bd
SSDEEP 98304:xaTPSALpajr/PMMPTZTOWvYQ7klZz8Wd4idk:clajr/PMMPTZTOWvCJ4R
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 1804	2596	rundll32.exe	28
PID 2596 wrote to memory of 1804	2596	rundll32.exe	28
PID 2596 wrote to memory of 1804	2596	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2596 -s 80
  2⤵
  PID:1804