3374d19f61bf83de14f2799b867fc4ee1a262bde023c34f761e1f379c29eb2ed | Triage

Analysis

max time kernel
42s
max time network
17s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 16:57

Sharing

Report Analysis Logs

General

Target

vk_swiftshader.dll
Size

5.1MB
MD5

fcc69745d24b38d987d3451487d64eb3
SHA1

23ffb108dd8c635801ee4b502effc159abc309f2
SHA256

4b4bd68d76a0178874e4350c2d2830a98fbeea6d1d36ccddb5249f4aaeded798
SHA512

939fe5b9c78e1c980a2297e06b131cba1feca6f44e1abb7c8b568bdbb041eaedbc09b9c0a5550bd8f71a90d7a12d71a90d80a6c7860b4d07d3f69d749a361d1d
SSDEEP

98304:onCo5V7feCUyLWStcagpKXcdxy87JHG3C97BWeC:cRheCUyLWStcagpKX6DiC9F

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 2744	1596	rundll32.exe	28
PID 1596 wrote to memory of 2744	1596	rundll32.exe	28
PID 1596 wrote to memory of 2744	1596	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1596 -s 80
  2⤵
  PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads