66745a4257b713585ce8e7b16edd8ae00d247f713ad6ea02dc4c39ef94b8c677

Resubmissions

28-05-2024 10:29

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 10:29

Target

vk_swiftshader.dll
Size

3.9MB
MD5

be0b7e972b358b4c8e7574f2a611393a
SHA1

a9352dbb92f8079a5147f0c7f6cc1dd370bcfa95
SHA256

c5c5f9a38b4503e92d2eec6c89d7fee059661689cac05ccc197fd1d151a242c7
SHA512

9ff56e6d26f95823d0f684ea9842f601b606bc468734d461d23623177083decf34698e1dead43f965a419db7c322256c6e2b410c6c688eb361e61cd683c06326
SSDEEP

49152:9WzcL9x2ydlDTa7GmidqJfec1e6u9px5Uxb92ZpJyTlN9lp/5iY8E8oP7qG7rm7N:ZaK1GPm4gmZZrVSowgaB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1660 wrote to memory of 1960	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 1960	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 1960	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 1960	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 1960	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 1960	1660	rundll32.exe	rundll32.exe
PID 1660 wrote to memory of 1960	1660	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
2⤵
PID:1960