e44fd281ff4ac842d66917e5f7bf43d7cf6b94afce95df2c8ee238e61cfbd0cd

Analysis

max time kernel
3s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 22:17

Target

vk_swiftshader.dll
Size

4.9MB
MD5

3a8600d95c9c163940f05e60a69eb457
SHA1

cce71f6a5490b48eaeb272cbf55792819fb2050b
SHA256

3477f8305c88838f894f0a304b8d2013542e9379f0310d398cd6a267e854e9af
SHA512

492a02352546065108c200b41026c711e09a32d3aa26e5356856d081bc1192445d7b98f789b6856b02217e84d8b3baa3288e3b9e359e59af6d0c7dcdd1888cf5
SSDEEP

49152:KGrnxGr9pGmj8pGtA/bVVku6KZlxsMOtVKOkc4FjHjAW3vZ1B93k1RE7SrLop8cJ:lnxY9NURayzxX61u0Lflb0wrD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2404	2140	rundll32.exe	29
PID 2140 wrote to memory of 2404	2140	rundll32.exe	29
PID 2140 wrote to memory of 2404	2140	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2140 -s 84
  2⤵
  PID:2404