a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 09:38

Target

vk_swiftshader.dll
Size

4.3MB
MD5

df2f469b761a706fba0b50149660f7cf
SHA1

2f9d8cb92b6e321e24a5437a1f77745a3507e7be
SHA256

be1e1dd3897dc9a997fdc5b3216f9af24c20fc678963f7486b0a6dae8900c274
SHA512

827e979f573f5cbbe6dd3c6bbe4414ab0d292005856b651b157f150a8d5605c3e77f76944dc0158ae9c632bdc31c243b1e9a467f03d3d3ddb08e95ff5b2e1347
SSDEEP

49152:nR4+5d8q8C/l80az6722j5V7IqD0o/1aZ/MMN5xSvEftz4VbHX5C+cn4br4nhXsH:dDTvEF89HPoptTgY+XB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 1708	2092	rundll32.exe	30
PID 2092 wrote to memory of 1708	2092	rundll32.exe	30
PID 2092 wrote to memory of 1708	2092	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2092 -s 80
  2⤵
  PID:1708