45ca1d26646fed29fa545ca768dc55bc85b650ce12e09995b74678c4d94c34e2

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 01:28

Target

vk_swiftshader.dll
Size

5.0MB
MD5

fb65e5828c023420da9e487c4d44c17c
SHA1

282586af18cc97ed99ce58d33d1aae48ca968f58
SHA256

30cce7a4619a5b84c041c28d8ea857ac142ac58d9b076009ad45dc4fa858d455
SHA512

28b82e2e8fc05941dcf5edc64deb65a288a2300697e2401690c5f11dc9714ef287744a858e917d561612a89f9f6a1e15ed6d27e63626b86dce04b7be08a1478d
SSDEEP

49152:fO6ftEjL3Zdon2+a/EgBqB1y91lxfAV7xWV9cO6NZ8m8xg1drRXmVEZvMUn0Hjy/:fLftlUSot6EmXxZdIOl5bzLB3dIW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 2996	1296	rundll32.exe	28
PID 1296 wrote to memory of 2996	1296	rundll32.exe	28
PID 1296 wrote to memory of 2996	1296	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1296 -s 80
  2⤵
  PID:2996