b693819185ea1a8f6b3cc03297eaf188553f7aaa455644c8341271fb104e4301

Analysis

max time kernel
132s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 03:47

Target
vk_swiftshader.dll
Size 3.6MB
Sample240511-ecm2daed35
SHA256 5ca1fa98343f80b585bc63b74f7bbb9521b0702a1cfc563642c340f22994038e
MD5 b3ef420c39b399973b8059a2c3d0c703
SHA1 dd282f6e442f77e945949b9ade290c9376ee2a15
SHA512 b4430ba8e9442980c9ed9a718072f8363ded731044a87661dbc201c3fbcefefb5d798fada031727d3688c253fd64ab56302f00cae89687b2639308573ef60e10
SSDEEP 98304:ezL61LJXfXM3LokJtHXFuVSdQvN5vT3cTYcBGXjE2J5VIZ7A8qYIGpznOb:ezmSXgRvcGXjDVIZM8rd
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1452	5620	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6024 wrote to memory of 5620	6024	rundll32.exe	83
PID 6024 wrote to memory of 5620	6024	rundll32.exe	83
PID 6024 wrote to memory of 5620	6024	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:6024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
  2⤵
  PID:5620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 600
    3⤵
    - Program crash
    PID:1452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 5620 -ip 5620
1⤵
PID:1476