68eeefd2b6980e569d198701c952a8bc7b7643809fa9c6216d2285a34d119719 | Triage

Analysis

max time kernel
454s
max time network
461s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
23-05-2024 06:06

Sharing

Report Analysis Logs

General

Target

vk_swiftshader.dll
Size

3.5MB
MD5

4faaf730349a80bacdb8cf4ad84ceb2b
SHA1

ecbb3f264017e5a450487bd44b3c89c283da77e6
SHA256

5f64e196c10031af294a9bcf49e4e25fbbc4c4adbcab1bff3983751bb32f4837
SHA512

b32e23ecc5b2d0a388e4378ca051fd471a5166a92f3efcc9c39a64a809942d8142a2d8e30b69dd2b0cb1828502c363b32044feb935b08435640020bb5172185e
SSDEEP

98304:mpo5SeKoeqFaimS0Y166QIT5T2P3gOusEznEmA:0y3Koelvm66QOT2fgRG

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

832 3816 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2256 wrote to memory of 3816	2256	rundll32.exe	rundll32.exe
PID 2256 wrote to memory of 3816	2256	rundll32.exe	rundll32.exe
PID 2256 wrote to memory of 3816	2256	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2256

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
2⤵
PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 448
3⤵
- Program crash
PID:832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3816 -ip 3816
1⤵
PID:1212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads