b1865a08154364f00bc4350a99012043bfca5b14734fb8ab505ade40dd6a0cc2

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 19:53

Target

vk_swiftshader.dll
Size

4.9MB
MD5

054c57ca1e444b9ba8262835e0cc947a
SHA1

c20b1ae7ec7315187051e7a46e14359f9d12b709
SHA256

011fc0f126868903dac9fecaa948eeffbc43aea2244cda071f69da08dc2f110e
SHA512

9d7854a681c4abffb95f17b0ec81ee21dc36c482fdd6dfdc8cc7296ca19e7193e7e2ef4ad71d28304cfbb94d96065ba53139d4042c31edf64897e9105ca5e360
SSDEEP

49152:iGrnxGr9HGmj8pGtA/bVVku6KZlxsMOtVKO0s4FDHjAWiqZ1x9Hk1RE7SrLop8cW:9nxY9bURaS+kHq1u0L0loWzrD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1624	1944	rundll32.exe	28
PID 1944 wrote to memory of 1624	1944	rundll32.exe	28
PID 1944 wrote to memory of 1624	1944	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1944 -s 80
  2⤵
  PID:1624