d1f9d8e109467ecb01945dea8dbb7ff17c7f8494dde58528ef21925b1de90697

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 01:59

Target
vk_swiftshader.dll
Size 4.3MB
Sample240614-ces93avdpn
SHA256 be1e1dd3897dc9a997fdc5b3216f9af24c20fc678963f7486b0a6dae8900c274
MD5 df2f469b761a706fba0b50149660f7cf
SHA1 2f9d8cb92b6e321e24a5437a1f77745a3507e7be
SHA512 827e979f573f5cbbe6dd3c6bbe4414ab0d292005856b651b157f150a8d5605c3e77f76944dc0158ae9c632bdc31c243b1e9a467f03d3d3ddb08e95ff5b2e1347
SSDEEP 49152:nR4+5d8q8C/l80az6722j5V7IqD0o/1aZ/MMN5xSvEftz4VbHX5C+cn4br4nhXsH:dDTvEF89HPoptTgY+XB
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1900	1612	rundll32.exe	28
PID 1612 wrote to memory of 1900	1612	rundll32.exe	28
PID 1612 wrote to memory of 1900	1612	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1612 -s 80
  2⤵
  PID:1900