90fd17cf8603ce14ef8e537d020bbe360bd1f856028da7cff94abbc76203a7ff

Analysis

max time kernel
119s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 15:03

Target
vk_swiftshader.dll
Size 5.0MB
Sample240608-se57macf91
SHA256 8ed50197b86ffcb2b9dbd744f168e862c239357900a75281376ceb6ad0283a38
MD5 41a4d1e69200554d6ec6424dc725ae76
SHA1 52116bbe1b6ab7c737246ce53c3b84d543e9b3d9
SHA512 5367764fe3927454b283799e82a12a73b0f0b957021857485a5e2fd3e99a56ac6b520253d3ca28c778a015c6e4dd867037f062fb72f865bfe234830804130ce8
SSDEEP 49152:5G7ixZvPbWjIXTFy1RYQZHJvuZBiDTwgvsrt5/PXd0kpmaN+WUf4CvB25zT7RCA/:w7iDPqjvzO1Lhgf49zT7grg4
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2052	2036	rundll32.exe	28
PID 2036 wrote to memory of 2052	2036	rundll32.exe	28
PID 2036 wrote to memory of 2052	2036	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2036 -s 84
  2⤵
  PID:2052