66745a4257b713585ce8e7b16edd8ae00d247f713ad6ea02dc4c39ef94b8c677

Resubmissions

28-05-2024 10:29

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 10:29

Target

vk_swiftshader.dll
Size

3.9MB
MD5

be0b7e972b358b4c8e7574f2a611393a
SHA1

a9352dbb92f8079a5147f0c7f6cc1dd370bcfa95
SHA256

c5c5f9a38b4503e92d2eec6c89d7fee059661689cac05ccc197fd1d151a242c7
SHA512

9ff56e6d26f95823d0f684ea9842f601b606bc468734d461d23623177083decf34698e1dead43f965a419db7c322256c6e2b410c6c688eb361e61cd683c06326
SSDEEP

49152:9WzcL9x2ydlDTa7GmidqJfec1e6u9px5Uxb92ZpJyTlN9lp/5iY8E8oP7qG7rm7N:ZaK1GPm4gmZZrVSowgaB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 692	1380	rundll32.exe	83
PID 1380 wrote to memory of 692	1380	rundll32.exe	83
PID 1380 wrote to memory of 692	1380	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
  2⤵
  PID:692