e26fb83b1a381cde24201826666079b36705ca41f2627c7b249d3bf0cdfa9f39

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 12:34

Target
vk_swiftshader.dll
Size 4.9MB
Sample240512-prvd4sfa5w
SHA256 3477f8305c88838f894f0a304b8d2013542e9379f0310d398cd6a267e854e9af
MD5 3a8600d95c9c163940f05e60a69eb457
SHA1 cce71f6a5490b48eaeb272cbf55792819fb2050b
SHA512 492a02352546065108c200b41026c711e09a32d3aa26e5356856d081bc1192445d7b98f789b6856b02217e84d8b3baa3288e3b9e359e59af6d0c7dcdd1888cf5
SSDEEP 49152:KGrnxGr9pGmj8pGtA/bVVku6KZlxsMOtVKOkc4FjHjAW3vZ1B93k1RE7SrLop8cJ:lnxY9NURayzxX61u0Lflb0wrD
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2020	2244	rundll32.exe	28
PID 2244 wrote to memory of 2020	2244	rundll32.exe	28
PID 2244 wrote to memory of 2020	2244	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2244 -s 80
  2⤵
  PID:2020