bb0bbd7cd226b02d5069ff946d8ef15ecde19f06d42c03f9e33a087863a7c6f8

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 02:06

Target

vk_swiftshader.dll
Size

4.3MB
MD5

df2f469b761a706fba0b50149660f7cf
SHA1

2f9d8cb92b6e321e24a5437a1f77745a3507e7be
SHA256

be1e1dd3897dc9a997fdc5b3216f9af24c20fc678963f7486b0a6dae8900c274
SHA512

827e979f573f5cbbe6dd3c6bbe4414ab0d292005856b651b157f150a8d5605c3e77f76944dc0158ae9c632bdc31c243b1e9a467f03d3d3ddb08e95ff5b2e1347
SSDEEP

49152:nR4+5d8q8C/l80az6722j5V7IqD0o/1aZ/MMN5xSvEftz4VbHX5C+cn4br4nhXsH:dDTvEF89HPoptTgY+XB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 3032	2424	rundll32.exe	28
PID 2424 wrote to memory of 3032	2424	rundll32.exe	28
PID 2424 wrote to memory of 3032	2424	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2424 -s 80
  2⤵
  PID:3032